Susana Alcala Wood, City Attorney Jorge Oseguera, City Auditor Mindy Cuppy, City Clerk Howard Chan, City Manager John Colville, City Treasurer City Council Report
915 I Street, 1st Floor
Sacramento, CA 95814
www.cityofsacramento.org
File ID: 2021-01444 January 4, 2022 Consent Item 06
Title: Continuous Cannabis Review: Business Operations Tax (BOT)
Location: Citywide
Recommendation: Pass a Motion approving the City Auditor’s Continuous Cannabis Review:
Business Operations Tax (BOT).
Contact: Jorge Oseguera, City Auditor, (916) 808-7270, [email protected], Office of the City Auditor
Presenter: None.
Attachments:
1-Description/Analysis
2-Continuous Cannabis Review: Business Operations Tax
File ID: 2021-01444 Consent Item 06
January 4, 2022
powered by Legistar™
City of Sacramento
Description/Analysis
Issue Detail: This report was approved as part of the City Auditor’s 2021-22 Audit Plan and documents the City Auditor’s Continuous Cannabis Review: Business Operations Tax (BOT), one of our office’s continuous cannabis monitoring reports.
Policy Considerations: The City Auditor’s presentation of the Continuous Cannabis Review:
BOT is consistent with the Mayor and City Council’s intent to have independent, objective, and ongoing evaluations of the City’s cannabis programs.
Economic Impacts: None.
Environmental Considerations: None.
Sustainability: None.
Commission/Committee Action: On November 30, 2021, the Budget and Audit Committee passed a motion to accept the City Auditor’s Continuous Cannabis Review: BOT and to forward to the City Council for approval.
Rationale for Recommendation: This staff report provides the City Council with information that may be used to meet its responsibility to provide oversight and supervision of the City Auditor and other City departments.
Financial Considerations: The cost of the City Auditor’s Continuous Cannabis Review: BOT was funded out of the FY2021/22 Office of the City Auditor Budget.
Local Business Enterprise (LBE): None.
Background: On January 14, 2020, the City Council adopted a resolution approving the establishment of a Cannabis Compliance Auditor in the Office of the City Auditor. The position is funded out of the Office of City Auditor’s budget and reimbursed by cannabis permit fees.
The Cannabis Compliance Auditor will continuously monitor and report on areas of risk through frequent and proactive audits of the City’s administration and regulation of cannabis programs.
Continuous Cannabis Review
Business Operations Tax (BOT)
Report# 2021/22-05|November 2021
Jorge Oseguera, City Auditor
Lynn Bashaw, Assistant City Auditor
Nathan Lugo, Senior Fiscal Policy Analyst
Performance Audit Division
Strengthening Security of the BOT Cash Payment Process Could Help to Reduce Risk
Four Cannabis Businesses Were Operating Without a BOT Certificate, Which Has Likely Resulted in Uncollected Tax Revenue
The Revenue Division Should Expand BOT Compliance Audits to Consider All Cannabis Businesses in the City to Reduce the Risk of Noncompliance
Office of the City Auditor
Continuous Cannabis Monitoring 1
Cannabis Business Operations Tax (BOT)
November 2021
The City of Sacramento’s Office of the City Auditor can be contacted by phone at 916-808-7270 or at the address below:
915 I Street
MC09100
Historic City Hall, Floor 2
Sacramento, CA 95814
Whistleblower Hotline
In the interest of public accountability and being responsible stewards of public funds, the City has established a whistleblower hotline. The hotline protects the anonymity of those leaving tips to the extent permitted by law. The service is available 24 hours a day, 7 days week, 365 days per year.
Through this service, all phone calls and emails will be received anonymously by third party staff.
Report online at https://www.reportlineweb.com/cityofsacramento or call toll-free: 888-245-8859.
Office of the City Auditor
Continuous Cannabis Monitoring 2
Cannabis Business Operations Tax (BOT)
November 2021
Table of Contents
Introduction ......................................................................................................................................... 3 Background .......................................................................................................................................... 3 Business Operations Tax (BOT) in the City of Sacramento ....................................................................... 3 Growth of Cannabis BOT ........................................................................................................................... 4 Information Systems Update ............................................................................................................... 5 Cannabis BOT Cash Payment Process Has Been Streamlined as a Result of COVID-19 ........................... 5 Objective, Scope, and Methodology ..................................................................................................... 6 Finding 1: Strengthening Security of the BOT Cash Payment Process Could Help to Reduce Risk .......... 7 Security Personnel Assigned to Monitor the Cannabis Cash Payment Transaction Did Not Maintain Security During Large Cash Transactions ................................................................................... 7 Revenue Division Staff Did Not Properly Safeguard Vault Keys According to their Policies and Procedures ................................................................................................................................................ 8 Vault Badge Access is Excessive and Not Periodically Evaluated for Appropriateness of Users .............. 9 Additional Security Measures Were Provided to the Revenue Division that are Not Detailed in this Report ............................................................................................................................................... 10 Finding 2: Four Cannabis Businesses Were Operating Without a BOT Certificate, Which Has Likely Resulted in Uncollected Tax Revenue ....................................................................................... 11 Four Permitted Cannabis Businesses Operating in the City Did Not Have a Valid Business Tax Account and Were Not Paying Business Operations Tax ........................................................................ 11 Finding 3: The Revenue Division Should Expand BOT Compliance Audits to Consider All Cannabis Businesses in the City to Reduce the Risk of Noncompliance ............................................... 13 The City Could Benefit from Expanding BOT Compliance Audits to Include all Cannabis Business Types Operating in the City of Sacramento ............................................................................. 13 Department Response ....................................................................................................................... 17
Office of the City Auditor
Continuous Cannabis Monitoring 3
Cannabis Business Operations Tax (BOT)
November 2021
Introduction
In accordance with the City Auditor’s 2021/22 Audit Plan, we are providing the second report in an ongoing series of Continuous Cannabis Monitoring Reviews of the City’s interdepartmental cannabis program. These reviews are designed to provide regular updates on areas of risk identified by the Office of the City Auditor, with the overall goal of assisting the City in maturing and optimizing its cannabis program and operations.
Continuous monitoring programs assist management to more quickly and accurately determine where it should be focusing attention and resources to improve processes, implement course corrections, address risks, or launch initiatives to better enable achievement of goals. Continuous monitoring is often an automated, ongoing process that gives management greater visibility into, and more timely information on, business processes designed to achieve strategic and operational goals. 1 This report
focuses on the Revenue Division’s Cannabis Business Operations Tax (BOT) processes.
We conducted this performance review in accordance with Generally Accepted Government Auditing Standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives.
We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.
The City Auditor’s Office would like to thank the Revenue Division for their collaboration during the ongoing review process.
Background
Business Operations Tax (BOT) in the City of Sacramento All businesses that operate in the City of Sacramento, or do business with the City of Sacramento, must obtain a Business Operations Tax (BOT) certificate, and pay a business operations tax. In July 2010, the City Council adopted an ordinance to tax medical marijuana businesses at four percent of gross receipts as codified in City Code Section 3.08 Business Operations Tax2.
In 2016, with the passage of Proposition 64 and the approaching legalization of recreational cannabis in California, the City code section applied to all new cannabis business types, not solely to the City’s
1 “Continuous Monitoring and Continuous Auditing - From Idea to Implementation.” Deloitte, Deloitte, 2010, www2.deloitte.com/us/en/pages/audit/articles/continuous-monitoring-continuous-auditing.html. 2 The Sacramento City Code section 3.08 Business Operations Tax contains subsection 3.08.205 Marijuana businesses. This subsection establishes a business operations tax rate of four percent of each dollar of gross receipts generated by a cannabis business.
Office of the City Auditor
Continuous Cannabis Monitoring 4
Cannabis Business Operations Tax (BOT)
November 2021
existing dispensaries. Currently, all cannabis businesses in the City are required to pay a business tax of four percent of gross receipts. Cannabis businesses are also required to remit the payment to the City monthly.
The City of Sacramento’s BOT is part of the Revenue Division’s Business Tax and Permits program in the Finance Department. Administration of BOT is the responsibility of the Business Tax and Permits Program Manager and overseen by the City’s Revenue Manager. Figure 1 shows how the BOT program fits in the City’s organizational structure.
Figure 1: Business Operations Tax Organizational Structure
Source: Auditor generated.
Growth of Cannabis BOT
Cannabis businesses began paying BOT at the beginning of fiscal year (FY) 2012. Initially, BOT paid by cannabis businesses was included in the City’s general BOT figures in the annual budget. In FY 2016, the City began separating cannabis BOT from other types of BOT for budget and reporting purposes. The following figure shows the growth of the City’s general BOT and cannabis BOT between FY 2012 and FY 2020.
Finance Department
Revenue Division
Business Tax & Permits
Business Operations Tax
(BOT)
Office of the City Auditor
Continuous Cannabis Monitoring 5
Cannabis Business Operations Tax (BOT)
November 2021
Figure 2: City of Sacramento Business Operations Tax (BOT) Between Fiscal Years 2012-2020
Source: City of Sacramento Approved City Budgets (FY 2013-22).
Information Systems Update
Prior to 2021, the Revenue Division utilized a tax administration software called Bizlink to record business tax accounts and related transactions. In May 2021, the Revenue Division implemented a new software solution called HdL Prime to replace Bizlink. The new software is designed to provide enhanced features, expand reporting capabilities and includes an online business portal that enables greater customer service and efficiency.
Cannabis BOT Cash Payment Process Has Been Streamlined as a Result of COVID-19
The Revenue Division often receives over 200 cannabis business tax payments monthly. Approximately 40 of those payments are made in person at City Hall each month. Prior to COVID-19, the Revenue Division accepted cannabis BOT cash payments of up to $2,000 at the City Hall Revenue Services Counter and payments of more than $2,000 required an appointment. After COVID-19 caused the City to shut down the City Hall Revenue Services Counter, all cannabis BOT cash payments required appointments. To adjust to the new operating environment, the Revenue Division implemented an online appointment scheduling process for these business tax payments. The new scheduling application has improved efficiency by allowing cannabis businesses to self-schedule appointments at pre- determined times rather than scheduling appointments via telephone.
FY 12 FY 13 FY 14 FY 15 FY 16 FY 17 FY 18 FY 19 FY 20
Cannabis BOT $- $- $- $- $4,234 $4,825 $6,881 $11,479 $14,857 General BOT $8,030 $8,248 $9,277 $9,991 $7,319 $7,986 $8,868 $8,111 $9,142 $-
$5,000
$10,000
$15,000
$20,000
$25,000
$30,000
City of Sacramento
Business Operations Tax (in 000s)
Office of the City Auditor
Continuous Cannabis Monitoring 6
Cannabis Business Operations Tax (BOT)
November 2021
In addition to a new appointment scheduling process, the Revenue Division also revised its process for counting cash payments from cannabis businesses. Prior to COVID-19, Revenue Division staff physically counted cash to verify the accuracy of the payment. This process required two cashiers to be in the presence of the cash for all transactions. To reduce physical interaction and promote social distancing, the Revenue Division eliminated the physical counting of cash from the process in January 2021.
Cannabis businesses are now instructed to arrive with their cash payment sealed in a bank deposit-type bag. The cannabis business taxpayer attests to the amount enclosed in the sealed bag, the taxpayer is provided a receipt for the transaction, and the funds are transferred to the bank for processing. This new process has greatly improved efficiency by reducing the number of Revenue Division staff to process cash tax payments from cannabis businesses from two to one. It has also cut down on counting errors and cash counting machine malfunctions since cash is being counted by only the BOT taxpayer and the City’s receiving bank. Any discrepancies identified by the Revenue Division are reconciled with the cannabis business.
Objective, Scope, and Methodology
The objectives of this review are to continuously evaluate the adequacy of internal controls over the Revenue Division’s cannabis BOT processes, monitor gross receipts reported and tax payments remitted to the City by cannabis businesses, and evaluate the effectiveness of BOT compliance audits of cannabis businesses. In performing our review, we interviewed Revenue Division Management to understand the business processes for the area under review, requested applicable policies and procedures and supporting documentation, observed three BOT cash payments, and reviewed business tax records and related reports. We also performed data analysis of cannabis BOT data in the previous and recently installed tax administration software.
Office of the City Auditor
Continuous Cannabis Monitoring 7
Cannabis Business Operations Tax (BOT)
November 2021
Finding 1: Strengthening Security of the BOT Cash Payment Process Could Help to Reduce Risk
Misappropriation of funds through fraud or theft can occur within any agency that handles cash. There are several procedures that an agency can put in place to prevent fraud or theft related to cash payments.3 For example, the Government Accountability Office’s (GAO) Standards for Internal Control in the Federal Government4 recommends putting physical controls in place to secure and safeguard vulnerable assets. This includes limiting physical access to cash. As part of our review, we inquired about the City Revenue Division’s process for receiving BOT cash payments.
As mentioned in the Background section, the Revenue Division often receives over 200 cannabis business tax payments monthly, including approximately 40 in-person cash payments at City Hall each month. During our review, we observed the cannabis BOT cash payment process to ensure that controls are applied as described in departmental policies and procedures. Through our observation, we identified opportunities to reduce the risk of fraud or abuse. Specifically, we found:
• Security personnel assigned to monitor the cannabis cash payment transaction did not maintain security during large cash transactions;
• Revenue Division staff did not properly safeguard vault keys according to their policies and procedures;
• Vault badge access is excessive and not periodically evaluated for appropriateness of users; and • Additional security measures were provided to the Revenue Division that are not detailed in this report.
We believe some additional security measures could help further strengthen the Revenue Division’s defense against fraud or abuse. As some of the issues identified are related to confidential security information, in accordance with auditing standards we have omitted some of the specific information on the City’s internal security processes from this report. However, the Revenue Division has been provided more detailed information to aid them in addressing the recommendations.
Security Personnel Assigned to Monitor the Cannabis Cash Payment Transaction Did Not Maintain Security During Large Cash Transactions
While the Revenue Division’s cash procedures only require one staff member to be present when receiving small cash payments, their procedures require the staff member to request a City Hall Security
3 “Implementing Cash Controls to Discourage Theft and Fraud.” RSM, RSM US LLP, 14 Mar. 2014, rsmus.com/what- we-do/services/risk-advisory/implementing-cash-controls-to-discourage-theft-and-fraud.html. 4 United States Government Accountability Office. GAO-14-704G Standards for Internal Control in the Federal Government. https://www.gao.gov/assets/gao-14-704g.pdf. Page 47.
Office of the City Auditor
Continuous Cannabis Monitoring 8
Cannabis Business Operations Tax (BOT)
November 2021
Guard monitor the transaction when payments are over a certain threshold. This helps to increase security for cannabis BOT cash payments.
When a Security Guard is required, according to the Revenue Division’s Cannabis Business Cash Tax Payment Procedures, the guard should remain in the presence of the cash from the start of the deposit to when the funds are placed in the vault, or when a second Revenue staff person is present. This promotes safety of the Revenue Division staff member and ensures that the cash payment is not in the sole custody of anyone for any period of time. However, during our observation of three cannabis BOT tax payments, where two of the transactions met the threshold that would require security be present, we noted that the Security Guard did not escort the cashier to the vault after the taxpayer had departed, or to the presence of another Revenue staff person.
While the Revenue Division does have a procedure in place for increasing the security of staff members in the presence of large cash deposits, it did not appear the procedure was always being followed by staff. We recommend the Revenue Division provide ongoing training and reinforce to employees the importance of adhering to the cash payment procedures, which require a security guard be present throughout the transaction during the receipt of large cash deposits.
RECOMMENDATION
We recommend the Revenue Division:
1. Ensure staff understand the importan ce of maintaining security for large cash transactions and adhere to the Cannabis Business Cash Tax Payment Procedures.
Revenue Division Staff Did Not Properly Safeguard Vault Keys According to their Policies and Procedures
A Key Management System refers to an organization’s processes around physical key management and, more broadly, how it controls access to crucial assets, people, information, and spaces. Keys grant access to an organization’s most important resources, and they should be protected relentlessly.5
The Revenue Division has implemented multiple layers of security and has established policies and procedures that provide guidance on physical access to the vault and vault key assignments. One layer of security is a dual key system to access the vault. According to the Revenue Division’s Alarm System, Vault Room and Vault Drawer Access Policy, vault keys should be assigned to individuals based on their
5 “The Ultimate Guide to Key Control in the Workplace.” Real Time Networks, 2021, www.realtimenetworks.com/resources/the-ultimate-guide-to-key-control-in-the-workplace.
Office of the City Auditor
Continuous Cannabis Monitoring 9
Cannabis Business Operations Tax (BOT)
November 2021
roles and responsibilities. The policy explicitly states that vault keys should be secured at all times by the individual they are assigned to.
During our observation of cannabis BOT cash transactions, we noted that while attempting to access the vault to deposit cash, Revenue Division staff was momentarily unable to locate a vault key. The vault key was subsequently located on a desk in an unattended cubicle. This practice is not in compliance with the Revenue Division’s policies. Without proper safeguards in place for vault keys, there is an increased risk of theft or abuse.
In our discussions with Revenue Division Management, we noted that the division has experienced challenges adhering to the Alarm System, Vault Room and Vault Drawer Access Policy due to the reductions in the number of on-site staff they can have in the building as a result of the ongoing COVID- 19 pandemic. We recommend updating existing processes and procedures with this limitation in mind to ensure that vault keys are safeguarded at all times.
RECOMMENDATION
We recommend the Revenue Division:
2. Review and revise policies and procedures over vault keys and vault key assignments to ensure that vault keys are safeguarded at all times.
Vault Badge Access is Excessive and Not Periodically Evaluated for Appropriateness of Users
According to ISACA, an organization that provides industry-leading knowledge and practices for information systems, an entity should establish sound policies and procedures for granting authorized users access while simultaneously protecting itself from unauthorized access.6 One method for addressing these risks is through the process of granting access on only a “need-to-know” basis where there is a legitimate business requirement to be granted access.
As part of our review, we requested a listing of the unique badge identities (IDs) that have been granted security badge access to the Revenue Division’s cash storage vault. Based on our review of this listing, we identified 195 unique badge IDs that have been granted access to the vault. While we did not validate the appropriateness of each user, we inquired with Revenue Division Management about the current level of access and they confirmed the volume could be effectively reduced. We also confirmed with management that a periodic review of vault door badge access has not been implemented.
6 Singleton, Tommie. “Mitigating IT Risks for Logical Access.” ISACA, 2010, www.isaca.org/resources/isaca- journal/past-issues/2010/mitigating-it-risks-for-logical-access.
Office of the City Auditor
Continuous Cannabis Monitoring 10
Cannabis Business Operations Tax (BOT)
November 2021
To limit the potential for fraud or abuse, vault access should be limited to only those employees that require it to complete their job duties. Access to the vault should be reviewed on a periodic basis to prevent individuals without a business need from being added in the future. We recommend ongoing reviews of vault access to ensure only authorized users can enter the area.
RECOMMENDATION
We recommend the Revenue Division:
3. Review current security badge access levels for the vault room to ensure all users are granted access based on a legitimate business need.
4. Implement a periodic review of vault access to ensure that inappropriate users are not added without management approval.
Additional Security Measures Were Provided to the Revenue Division that are Not Detailed in this Report
Audit standards allow for the exclusion of information from a publicly available or widely distributed report in circumstances associated with public safety, privacy, or security concerns. In such circumstances, auditors may issue a separate memo containing such information and distribute the report only to those parties responsible for acting on the auditor’s recommendations. During our review of the cannabis BOT cash payment process, we identified additional security measures that could be implemented by the Revenue Division to enhance physical security of cash processes. We have provided the details of this information to the Revenue Division for further consideration. We recommend the Revenue Division consider implementing these additional security measures.
RECOMMENDATION
We recommend the Revenue Division:
5. Consider implementing additional security measures identified.
Office of the City Auditor
Continuous Cannabis Monitoring 11
Cannabis Business Operations Tax (BOT)
November 2021
Finding 2: Four Cannabis Businesses Were Operating Without a BOT Certificate, Which Has Likely Resulted in Uncollected Tax Revenue
The City’s Revenue Division issues BOT certificates to businesses as a mechanism to collect business tax payments. The Office of Cannabis Management (OCM) issues Business Operating Permits (BOPs) which are required to operate a cannabis business in the City of Sacramento. We reviewed BOT compliance for cannabis businesses with active BOPs and identified instances where permitted cannabis businesses had not obtained a valid BOT certificate and did not have a valid business tax account. When a cannabis business has not obtained a BOT certificate prior to operating, the City may be missing out on collecting tax payments from that business. Specifically, we found:
• Four permitted cannabis businesses operating in the City did not have a valid business tax account and were not paying business operations tax.
As part of the BOP application review process, OCM works with the Revenue Division to verify BOT compliance. However, neither OCM nor the Revenue Division identified four cannabis businesses that had failed to obtain a BOT certificate prior to operating. We recommend the Revenue Division bring the identified businesses into compliance and collect any past due taxes. We also recommend the Revenue Division and OCM work together to strengthen controls in the BOT verification process during permit issuance and renewal. This will help to ensure all cannabis businesses have a BOT certificate and are remitting business tax payments to the City.
Four Permitted Cannabis Businesses Operating in the City Did Not Have a Valid Business Tax Account and Were Not Paying Business Operations Tax Chapter 5.150 Article II of the City Code details the regulations for cannabis business permit applications, procedures, and appeals. According to Section A (7)(d) Tax Compliance, a cannabis business applicant is required to provide a valid city BOT certificate number as part of the permit application process. The City’s Office of Cannabis Management (OCM) reviews and processes cannabis business permits. As part of the permit application process, OCM conducts reviews to ensure all permit requirements have been met. As part of their review processes, OCM verifies with the City’s Revenue Division whether a business has applied for a BOT certificate.
We tested BOT compliance for all permitted cannabis businesses operating in the City as of October 15, 2021. To perform our testing, we obtained a listing of active cannabis BOPs from the City’s business permitting system and reconciled the listing with the Revenue Division’s business tax administration system to verify each business had obtained a BOT certificate and had a corresponding business tax account. In our review of 230 active cannabis BOPs, we identified four permitted cannabis businesses that did not have a valid business tax account. In other words, these businesses are not in compliance with the City’s cannabis BOT regulations and have not been paying the required four percent monthly
Office of the City Auditor
Continuous Cannabis Monitoring 12
Cannabis Business Operations Tax (BOT)
November 2021
cannabis BOT. For these businesses, we reviewed correspondence between OCM and Revenue Division that indicate the Revenue Division did not provide accurate information to OCM on the status of one cannabis business and did not follow up on a BOT certificate application for another. We also identified one cannabis business that did not have a valid BOT certificate but was not yet operating. We did not consider this business as noncompliant for the purpose of this finding.
To estimate the potential business tax liability for the four noncompliant cannabis businesses, we calculated the average monthly payment for each cannabis business type7. The range of monthly BOT payments calculated for each business type is between $2,800 to $10,400. Using average monthly payment amounts for each cannabis business type, we estimate that the potential tax owed to the City could be as much as $227,000. It is important to note that this is only an estimate based on available data. While this amount only represents approximately one percent of total cannabis BOT revenue in FY 2021, it has the potential to increase with the growth of permitted cannabis businesses in the City if not addressed.
City code requires cannabis businesses operating in the City to pay all applicable taxes, which includes BOT. We recommend the Revenue Division validate the amount of taxes owed by each business and ensure these businesses are brought into compliance by remitting the appropriate amount of BOT to the City. We also recommend the Revenue Division and OCM work collaboratively to strengthen controls in BOT verification processes to ensure all operational cannabis businesses have a valid BOT certificate and are paying business taxes.
RECOMMENDATION
We recommend:
6. The Revenue Division bring identified cannabis businesses into compliance with the City’s BOT regulations and collect past due taxes.
7. The Revenue Division and the Office of Cannabis Management work collaboratively to strengthen controls in the BOT verification processes during BOP issuance and renewal.
7 The calculation of average monthly BOT payments for each cannabis business type used data from the Revenue Division’s business tax administration system, HdL Prime, between the years 2018-2021.
Office of the City Auditor
Continuous Cannabis Monitoring 13
Cannabis Business Operations Tax (BOT)
November 2021
Finding 3: The Revenue Division Should Expand BOT Compliance Audits to Consider All Cannabis Businesses in the City to Reduce the Risk of Noncompliance
Tax compliance audits can be used to identify deviations from laws or regulations and are often completed on a recurring basis to provide assurance of continued compliance. Audits can also provide clarity on the application of the law for taxpayers and identify recordkeeping deficiencies. 8 While the
City is not required to perform tax compliance audits of cannabis businesses, it is a good business practice to ensure entities are remitting the correct tax payments and provides the City with an opportunity to address any deficiencies identified. A risk of allowing businesses to self-report their gross receipts is that they may be tempted to underreport sales in order to reduce their tax burden.
Avenu Insights & Analytics (Avenu Insights) is a third-party vendor that performs Cannabis Revenue Audit and Recovery Services (BOT compliance) on behalf of the City’s Revenue Division. These audits are designed to verify that cannabis businesses are properly calculating and self-reporting gross receipts, per the City's tax ordinance. These audits have also helped to identify instances of poor or inconsistent recordkeeping practices by storefront dispensaries. We reviewed the City’s cannabis BOT compliance audits performed on the City’s storefront dispensaries and found:
• The City Could Benefit from Expansion of BOT Compliance Audits to Include all Cannabis Business Types Operating in the City of Sacramento.
As the cannabis industry continues to mature and the various parts of the cannabis supply chain become more prevalent in the City, we believe it is time to consider expanding BOT compliance audits to include all cannabis business types. Similar to the BOT compliance audits of storefront dispensaries already being performed, an expansion will help to identify anomalies or concerns. It will also help to ensure more types of cannabis businesses are calculating the tax correctly and provide assurance that they are accurately self-reporting and remitting the appropriate amount of BOT to the City. It is important to note that the Revenue Division has been looking into expanding the audits to include additional cannabis business types, however no additional audits have been performed.
The City Could Benefit from Expanding BOT Compliance Audits to Include all Cannabis Business Types Operating in the City of Sacramento
In reviewing the City’s cannabis BOT program, we analyzed BOT payment data using Revenue Division’s recently implemented tax administration software to understand the allocation of BOT revenue
8 “Strengthening Tax Audit Capabilities: General Principles and Approaches.” Organization for Economic Co- Operation and Development, Center for Tax Policy and Administration, 2006, www.oecd.org/tax/forum-on-tax- administration/publications-and-products/37589900.pdf.
Office of the City Auditor
Continuous Cannabis Monitoring 14
Cannabis Business Operations Tax (BOT)
November 2021
generated by different types of cannabis businesses in the City. The following figure illustrates how cannabis BOT revenue from storefront dispensaries has changed since 2018.
Figure 3: Percentage of Total BOT Revenue by Cannabis Business Type
Source: Auditor generated using information from HdL Prime Business Operations Tax (BOT) software used by Revenue Division.
As evidenced by the data, the City’s cannabis BOT revenue is changing from being primarily driven by the City’s storefront dispensaries to being driven by other cannabis business types, such as manufacturing, distribution, and cultivation. For example, in FY 2018 other cannabis business types made up 17 percent of total cannabis BOT revenue, while in FY 2021 other cannabis business types had increased to 59 percent of total cannabis BOT revenue.
In FY 2021, approximately 190 cannabis businesses paid the City’s BOT, yet only the City’s storefront dispensaries received a BOT compliance audit from Avenu Insights. Other cannabis business types, such as manufacturing, distribution and cultivation, have not been subject to BOT compliance audits. Other cannabis business types now comprise more than 50 percent of cannabis BOT revenue. However, the City’s approach to BOT compliance audits has not changed to reflect this trend. It is important to note that the Revenue Division has been actively considering auditing other cannabis business types but has not yet started the process.
83%
51% 51%
41%
17%
49% 49%
59%
0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
100%
FY 2018 FY 2019 FY 2020 FY 2021
Percentage of Total BOT Revenue By Cannabis Business Type Storefront Dispensary Other Cannabis Business Types
Office of the City Auditor
Continuous Cannabis Monitoring 15
Cannabis Business Operations Tax (BOT)
November 2021
The importance of performing regular compliance audits is demonstrated clearly by the results of the most recent storefront dispensary audits performed by Avenu Insights. The recent storefront dispensary BOT compliance audits performed by Avenu Insights found that 22 of the 25 dispensaries reviewed contained one or more issues. Figure 4 summarizes the errors identified during the audits.
Figure 4: Summary of Findings from Avenu Insights’ Tax Compliance Audits9 Description of Finding Number of Findings
Underreporting of Gross Receipts (Unpaid BOT) 8
Overreporting Gross Receipts (Overpaid BOT) 14
Availability of Financial Records 4
Inventory Errors 4
Total Findings (25 BOT compliance Audits) 30
Source: Auditor generated based on Avenu Insights audit reports.
Avenu Insights noted eight instances where a storefront dispensary underreported its gross receipts resulting in unpaid BOT. Common reasons for the underreporting included passing through the four percent BOT on to customers but not including this amount in reported gross receipts, and incorrectly calculating State sales and excise taxes. We confirmed that the additional BOT due was invoiced and has been collected from seven of the eight dispensaries with unpaid BOT.
Avenu Insights also noted 14 instances where a storefront dispensary overreported its gross receipts resulting in overpaid BOT. The most common reason for overreporting gross receipts was an incorrect application of the State’s 15 percent excise tax. Per Sacramento City Code, businesses have a year from the date of an overpayment to request a refund. We confirmed storefront dispensaries that requested a refund within this timeframe were credited on their City business tax account. The following table shows the amounts identified in each type of financial finding. Based on the Avenu Insights audits, overall dispensaries were refunded slightly more than they owed, which indicate the audits do not necessarily focus on maximizing tax revenue for the City, but also help to educate cannabis businesses about how to properly report their tax liability.
Figure 5: Summary of Financial Findings Identified in City Auditor Review of 25 BOT Compliance Audits
Type of Financial Finding Total Amount Average Amount
Underreporting of Gross Receipts (Unpaid BOT) $195,059 $24,382 Overreporting Gross Receipts (Overpaid BOT) $(200,705) $(14,336) Source: Auditor generated based on Avenu Insights audit reports.
9 The Summary of Findings from Avenu Insights’ Tax Compliance Audits table counts financial findings based on a net calculation. In some instances, storefront dispensaries both overreported and underreported gross receipts during the period under review. The table indicates whether the dispensary’s net financial findings were overreporting or underreporting of gross receipts.
Office of the City Auditor
Continuous Cannabis Monitoring 16
Cannabis Business Operations Tax (BOT)
November 2021
In addition to financial findings, the BOT compliance audits also identified four instances where a storefront dispensary could not provide adequate financial and business records to Avenu Insights’ auditors, which is concerning because cannabis businesses are required to maintain financial records and provide them during an audit. Also, in conducting inventory audit procedures, Avenu Insights identified four instances where a dispensary’s inventory records contained a discrepancy from inventory on-hand. As evidenced by these recent dispensary audits, regular compliance audits can help to identify errors and address concerns before they become larger problems. They can also help to educate cannabis businesses about properly calculating and reporting their tax revenues, the importance of maintaining proper accounting records, and mitigate some of the risks associated with relying on businesses to self-report their gross receipts.
While it is possible to routinely audit all storefront dispensaries in the city, since there is a small number, we recognize the goal of auditing all cannabis business types is likely not feasible given the nearly 190 cannabis businesses paying business tax in the City. A risk-based approach is a systematic process that applies quantitative and qualitative factors that identify higher areas of risk and can aid the Revenue Division in selecting which order, or with what frequency, to audit cannabis businesses. By using a risk- based approach to select cannabis businesses for BOT compliance audits, the Revenue Division can expand their oversight while focusing resources where they are likely to address the most significant risks of non-compliance.
With a changing cannabis industry in Sacramento, the risks of BOT non-compliance have changed to include more business types. The City could provide more broad oversight by expanding BOT audits to include all types of cannabis businesses. We agree with the Revenue Division and believe a modification to the approach could help to ensure the risks of BOT non-compliance are reduced, given that these businesses self-report their revenue and the City has limited ability to determine whether the amounts reported are accurate. We recommend expanding BOT compliance audits to include all cannabis business types and using a risk-based approach in selecting which businesses to review.
RECOMMENDATION
We recommend the Revenue Division:
8. Develop and implement a risk-based approach to selecting cannabis businesses for BOT compliance audits.
9. Expand BOT compliance audits to include all cannabis business types operating in the City of Sacramento.
City Hall | 915 I Street, Fifth Floor | Sacramento, CA 95814-2064 | 916-808-5704
L
MEMORANDUM
DATE: November 16, 2021
TO: Jorge Oseguera, City Auditor
FROM: Leyne Milstein, Assistant City Manager LM
CC: Dawn Holm, Director of Finance
Davina Smith, Cannabis Manager
SUBJECT: Auditor’s Report 2021/22-05 Continuing Cannabis Review Business Operations Tax Report - Management Response
The Finance Department and Office of Cannabis Management have reviewed the Sacramento City Auditor’s Continuous Cannabis Review Business Operations Tax Report #2021/22-05 and present the following management responses.
Finding 1 Stated Condition: Security personnel did not maintain security.
Management comment: We agree with the finding that although security personnel were present for the duration of tax appointments, in two instances after taxpayers left the office, the security personnel did not escort the cashier to the vault or to another staff member in accordance with the Revenue Division procedures.
The offices have been closed to the public since March 2020 creating a unique situation that has extended longer than expected. Revenue staff did not realize that even though the offices were closed to the public and the doors from the City Hall lobby were locked that the security measure of escorting staff to the vault was still required. Management has reviewed the process with the City Hall security team and Revenue staff and the procedures are being followed.
Finding 1 Stated Condition: Staff did not properly safeguard vault keys.
Management comment: We agree that one of two keys was not maintained by an assigned individual. In compliance with the City directive for non-essential staff to work remotely, only 25% of Revenue staff are present in City Hall. While a supervisor
City Hall | 915 I Street, Fifth Floor | Sacramento, CA 95814-2064 | 916-808-5704
attended a meeting in an isolated conference room, one of the dual vault drawer keys was left for access during tax appointments.
A contingency procedure has been added to the key assignment procedure that in the event of a low-staffing situation, staff must provide a key to a substitute for the duration of a meeting or absence from a post.
Finding 1 Stated Condition: Vault badge access is excessive and not periodically evaluated for appropriateness of users.
Management comment: We agree with Recommendations 3 and 4, that the list of personnel who have access to the vault should be reviewed on a regular basis, and the Revenue Division staff are in the process of reviewing the list of personnel with badge access to the vault room, contacting the department managers to verify the need, and working with facilities staff to determine whether the vault can be isolated separately from other limited access offices within the security system. If the vault can be a separate location in the security system, the Revenue Division will request its staff be included in the badge assignment workflow for staff who receive access.
We disagree that the condition described rises to the level of a deficiency that impedes the control objective to safeguard items in the vault because other layers of vault security and controls preclude unauthorized personnel from accessing any vault contents without detection or other physical barriers.
Finding 1 Stated Condition: Additional security measures not detailed in the report.
Management comment: We will evaluate the Auditor’s suggestions for additional security measures; however we disagree that the condition described rises to the level of a finding as these are recommendations for enhancements and no deficiency in control was identified or found to be inadequate to meet the objective to safeguard assets.
Finding 2 Stated condition: Four instances of BOT non-compliance.
Management comment: We agree with the finding and recommendations and have contacted the businesses to bring them into compliance.
Finding 3 Stated condition: Expand business operations tax compliance audits to consider all cannabis businesses in the City.
Management comment: We disagree the condition described rises to the level of a finding because the Revenue Division in 2020, independent of City Auditor discussion or recommendation, had already initiated plans and budget strategies to expand audits to non-dispensary taxpayers. Reporting an existing operating plan as a finding is not warranted.
Leyne Milstein (Nov 17, 2021 11:23 PST)
Email: [email protected]
Signature: