City of Sacramento
City Council - 5PM Report
915 I Street Sacramento, CA 95814
www.cityofsacramento.org
File ID: 2022-02166 1/10/2023 Consent Item 18.
Audit of the Cannabis Code Enforcement Unit (CCEU)
File ID: 2022-02166
Location: Citywide
Recommendation: Pass a Motion approving the City Auditor’s Audit of the Cannabis Code Enforcement Unit (CCEU).
Contact: Jorge Oseguera, City Auditor, (916) 808-7270, [email protected], Office of the City Auditor
Presenter: None.
Attachments:
1-Description/Analysis
2-Audit of the Cannabis Code Enforcement Unit (CCEU)
Description/Analysis
Issue Detail: This report was approved as part of the City Auditor’s 2021-22 Audit Plan and documents the City Auditor’s Audit of the Cannabis Code Enforcement Unit (CCEU), one of our office’s continuous cannabis monitoring reports.
Policy Considerations: The City Auditor’s presentation of the Audit of the Cannabis Code Enforcement Unit (CCEU) is consistent with the Mayor and City Council’s intent to have independent, objective, and ongoing evaluations of the City’s cannabis programs.
Economic Impacts: None.
Environmental Considerations: None.
Sustainability: None.
Commission/Committee Action: On December 6, 2022, the Budget and Audit Committee passed a motion to accept the City Auditor’s Audit of the Cannabis Code Enforcement Unit (CCEU) and to
File ID: 2022-02166 1/10/2023 Consent Item 18.
forward to the City Council for approval.
Rationale for Recommendation: This staff report provides the City Council with information that may be used to meet its responsibility to provide oversight and supervision of the City Auditor and other City departments.
Financial Considerations: The cost of the City Auditor’s Audit of the Cannabis Code Enforcement Unit (CCEU) was funded out of cannabis permit fees.
Local Business Enterprise (LBE): None.
Background: On January 14, 2020, the City Council adopted a resolution approving the establishment of a Cannabis Compliance Auditor in the Office of the City Auditor. The position is included in the Office of City Auditor’s budget and reimbursed by cannabis permit fees.
The Cannabis Compliance Auditor will continuously monitor and report on areas of risk through frequent and proactive audits of the City’s administration and regulation of cannabis programs.
Audit of the Cannabis Code
Enforcement Unit (CCEU)
Report# 2022/23-06|October 2022
Jorge Oseguera, City Auditor
Lynn Bashaw, Assistant City Auditor
Nathan Lugo, Senior Fiscal Policy Analyst
Performance Audit Division
Two Cannabis Businesses Were Not Being Regularly Inspected and Some Inspections Were Not Performed Timely
Inspection Processes Could be Strengthened with the Use of Checklists and Standardized Practices
Some Cannabis Code Enforcement Data in CitizenServe is Missing or Inconsistent
Management Could Promote Efficiency and Effectiveness Through the Use of Performance Metrics and Documented Reviews
Office of the City Auditor
Continuous Cannabis Monitoring 1
Cannabis Code Enforcement Unit (CCEU)
October 2022
The City of Sacramento’s Office of the City Auditor can be contacted by phone at 916-808-7270 or at the address below:
915 I Street
MC09100
Historic City Hall, Floor 2
Sacramento, CA 95814
Whistleblower Hotline
In the interest of public accountability and being responsible stewards of public funds, the City has established a whistleblower hotline. The hotline protects the anonymity of those leaving tips to the extent permitted by law. The service is available 24 hours a day, 7 days week, 365 days per year.
Through this service, all phone calls and emails will be received anonymously by third party staff.
Report online at https://www.reportlineweb.com/cityofsacramento or call toll-free: 888-245-8859.
Office of the City Auditor
Continuous Cannabis Monitoring 2
Cannabis Code Enforcement Unit (CCEU)
October 2022
Table of Contents
Introduction ............................................................................................................................................ 4 Background ............................................................................................................................................. 4 City of Sacramento Code Compliance Division ................................ ................................ ..................... 4 Cannabis Program Enforcement................................ ................................ ................................ ........... 5 Cannabis Program Enforcement Activities ................................ ................................ ........................ 6 Cannabis Policy and Enforcement Multi-Year Operating Project................................ ........................... 7 Regulations ................................ ................................ ................................ ................................ .......... 7 Information Systems ................................ ................................ ................................ ............................ 8 Objective, Scope, and Methodology ....................................................................................................... 8 Finding 1: Two Cannabis Businesses Were Not Being Regularly Inspected and Some Inspections Were Not Performed Timely ................................................................................................................. 10 Two Cannabis Businesses Were Operating Without Being Regularly Inspected ................................ .. 10 Six Percent of Cannabis Business Inspections We Reviewed Were Not Conducted in Accordance with the Established Inspection Schedule ................................ ................................ ....... 12 Finding 2: Inspection Processes Could be Strengthened with the Use of Checklists During the Inspection and by Having Written Standardized Practices .................................................................... 14 Inspections are Conducted Without Utilizing a Checklist During the Inspection ................................ .. 14 Inspection Checklists................................ ................................ ................................ ...................... 15 Observation of CCEU Inspections ................................ ................................ ................................ ... 15 Inventory Inspection Procedures are Informal and Not Documented ................................ ................. 17 Finding 3: Some Cannabis Code Enforcement Data in CitizenServe is Missing or Inconsistent ............. 20 Documents and Photographs Were Not Always Uploaded to CitizenServe following Inspections in Accordance with Policies and Procedures ................................ ................................ .... 20 Photographs Were Not Uploaded to CitizenServe After an Inspection................................ ............ 21 Additional Testing of Inspection Documentation in CitizenServe ................................ .................... 21 Evidence of Business Compliance for Issued Violations and Administrative Penalties is Inconsistent ................................ ................................ ................................ ................................ ....... 22 Some Enforcement Activities Were Not Documented as Completed in CitizenServe .......................... 26 Finding 4: Management Could Promote Efficiency and Effectiveness Through the Use of Performance Metrics and Documented Reviews .................................................................................. 28 The Cannabis Code Enforcement Unit has not Established Performance Metrics ............................... 28
Office of the City Auditor
Continuous Cannabis Monitoring 3
Cannabis Code Enforcement Unit (CCEU)
October 2022
Supervisory Review of Inspection Work is Informal and Not Documented................................ .......... 29 Safety Assets are not Tracked or Periodically Reconciled ................................ ................................ ... 30 Department Response .......................................................................................................................... 33 Appendix .............................................................................................................................................. 36 BOP Final Walkthrough Evaluation Form (BOP Form) ................................ ................................ ......... 36
Office of the City Auditor
Continuous Cannabis Monitoring 4
Cannabis Code Enforcement Unit (CCEU)
October 2022
Introduction
In accordance with the City Auditor’s 2022/23 Audit Plan, we are providing the third report in an ongoing series of Continuous Cannabis Monitoring Reviews of the City’s interdepartmental cannabis program. These reviews are designed to provide regular updates on areas of risk identified by the Office of the City Auditor, with the overall goal of assisting the City in maturing and optimizing its cannabis program and operations.
Continuous monitoring programs assist management to more quickly and accurately determine where it should be focusing attention and resources to improve processes, implement course corrections, address risks, or launch initiatives to better enable achievement of goals. Continuous monitoring is often an automated, ongoing process that gives management greater visibility into, and more timely information on, business processes designed to achieve strategic and operational goals. 1 This report focuses on the Cannabis Code Enforcement Unit (CCEU) within the City’s Code Compliance Division of the Community Development Department.
We conducted this performance review in accordance with Generally Accepted Government Auditing Standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives.
We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.
The City Auditor’s Office would like to thank the Cannabis Code Enforcement Unit for their collaboration during the ongoing review process.
Background
City of Sacramento Code Compliance Division
The City of Sacramento Code Compliance Division promotes a safe and desirable living environment for Sacramento residents and business owners by working with the community. In partnership with residents, neighborhood associations, public service agencies and city departments, the Code Compliance Division:
• Facilitates voluntary compliance with City laws and codes; • Empowers community self-help programs;
• Develops public outreach programs; and
1 “Continuous Monitoring and Continuous Auditing - From Idea to Implementation.” Deloitte, 2010, www2.deloitte.com/us/en/pages/audit/articles/continuous-monitoring-continuous-auditing.html.
Office of the City Auditor
Continuous Cannabis Monitoring 5
Cannabis Code Enforcement Unit (CCEU)
October 2022
• Establishes community priorities for enforcement programs.
The Code Compliance Division does this through programs such as neighborhood code and business compliance, vacant building monitoring, dangerous building inspections, graffiti abatements, and rental housing inspections.
Cannabis Program Enforcement
The Office of Cannabis Management funds five full-time positions in the Code Compliance Division. This includes three code enforcement officer positions that make up the Cannabis Code Enforcement Unit (CCEU) in the Neighborhood Code and Business Compliance Program. The CCEU was established to assist the Office of Cannabis Management (OCM) with the enforcement of regulations adopted by the City of Sacramento for commercial cannabis. The CCEU is managed by a Senior Code Enforcement Officer and supported by two Code Enforcement Officers. While the CCEU is part of the Neighborhood Code and Business Compliance Division, they also work with OCM to coordinate and conduct permitting inspections. Additionally, OCM funds two positions in the Cannabis Building Inspections program, however, that program is not part of this review.
The organizational chart below shows the CCEU within the City’s organizational structure and the corresponding number of positions funded by OCM. The box highlighted in purple is the CCEU, and is the focus of this review.
Figure 1: Cannabis Code Enforcement Organizational Structure
Source: Auditor generated based on the Community Development Department’s functional organizational chart updated January 10, 2022.
Office of the City Auditor
Continuous Cannabis Monitoring 6
Cannabis Code Enforcement Unit (CCEU)
October 2022
Cannabis Program Enforcement Activities
The CCEU conducts a variety of activities that it uses to educate and enforce compliance with cannabis business regulations in the city of Sacramento. The CCEU conducts walkthrough inspections of cannabis businesses and works closely with OCM to ensure all compliance requirements are met prior to permitting. Periodic inspections are also conducted at regular intervals for all types of cannabis businesses. When a business is found to be noncompliant, the CCEU has the discretion to issue notice of violations and penalties to encourage compliance. CCEU conducts follow-up inspections to verify whether a business has achieved compliance following issuance of a notice of violation or penalty. In addition, the CCEU also investigates complaints related to cannabis businesses and verifies the operational status of cannabis businesses when required.
Figure 2 illustrates the various activities that were conducted by the CCEU between 2018-2021. Periodic Inspections include inspections conducted at regular intervals (e.g. 30 or 90 day inspections).
Walkthrough Inspections include activities related to the issuance of cannabis business operating permits. Violation and Penalties include issuance as well as follow-up activities. Finally, Other Inspections includes investigation of complaints and operational status inspections.
Figure 2: CCEU Program Enforcement Activities by Year
Source: Auditor generated based on CitizenServe data.
2018 2019 2020 2021
Periodic Inspections 37 317 626 1203
Walkthrough Inspections 0 34 139 69
Violation & Penalties 0 90 164 250
Other Inspections 2 38 181 102
0 200
400
600
800
1000
1200
1400
Program Enforcement Activities by Year
Office of the City Auditor
Continuous Cannabis Monitoring 7
Cannabis Code Enforcement Unit (CCEU)
October 2022
Cannabis Policy and Enforcement Multi-Year Operating Project The City has established a multi-year operating project (MYOP) called Cannabis Policy and Enforcement.
This MYOP funds full-time positions in various City departments that perform duties related to the City’s cannabis program. The MYOP provides funding for positions in the City Attorney’s Office, Community Development Department, Finance Department, Fire Department, and Police Department. Funding for the MYOP comes from the Business Operations Taxes (BOT), administrative penalties relating to illegal cultivation of cannabis, housing and dangerous building fines, and excess operating revenues from cannabis permitting fees collected by OCM. The table below shows MYOP funding for cannabis code enforcement activities between 2018 and 2021.
Figure 3: Cannabis MYOP Funding of Cannabis Code Enforcement Activities between 2018-2021
Source: Auditor generated based on SACGL07 - GL Report by Project (I06420000).
As of 2021, this MYOP funds the 5 full-time positions in the Code Compliance Division. This includes a Senior Code Enforcement Officer and two Code Enforcement Officers in the CCEU, and two Building Inspector positions in the Housing and Dangerous Buildings program.
Regulations
The CCEU is tasked with enforcing regulations outlined in chapter 5.150 of the City Code, Cannabis Businesses. The following table provides a list of the sections of chapter 5.150:
2018 2019 2020 2021
Total MYOP Expense $434,638 $2,435,532 $3,105,490 $2,588,346 Cannabis Code Enforcement $88,819 $365,559 $576,710 $526,299 $-
$500,000
$1,000,000
$1,500,000
$2,000,000
$2,500,000
$3,000,000
$3,500,000
$4,000,000
Cannabis Code Enforcement MYOP Expense
Cannabis Code Enforcement Total MYOP Expense
Office of the City Auditor
Continuous Cannabis Monitoring 8
Cannabis Code Enforcement Unit (CCEU)
October 2022
Figure 4: Sacramento City Code Chapter 5.150 Sections (Cannabis Businesses) Chapter 5.150 Section Section Description
Article I. General Provisions
Article II. Cannabis Business Permit Applications, Procedures, and Appeals Article III. Storefront Cannabis Dispensaries
Article IV. Cannabis Cultivation
Article V. Cannabis Testing Laboratory
Article VI. Cannabis Manufacturing
Article VII. Delivery-Only Cannabis Dispensary
Article VIII. Cannabis Distribution
Article IX. Southeast Industrial Area Dispensaries Authorized to Deliver Article X. Cannabis Microbusiness
Source: Sacramento City Code
The chapter 5.150 sections that are titled by cannabis business type (e.g., Cannabis Cultivation, Cannabis Manufacturing, etc.) detail the business permitting regulations that apply to that specific type of cannabis business. Although some of the regulations are similar across business types, there are many regulations unique to each business type.
2 Information Systems
The primary information system used by CCEU employees to track their cannabis code enforcement activities is called CitizenServe. Documents, photographs, and case notes can be uploaded into CitizenServe. Other information systems used for cannabis code enforcement include Accela, which the City uses for administration of cannabis business operating permits (BOPs). Within Accela, elements of a cannabis BOP application can be reviewed, such as the facility plans, security plans and other related documents.
Objective, Scope, and Methodology
The objectives of this review are to (1) assess the adequacy of cannabis code enforcement activities (e.g., inspections, reports, violations, etc.) over local cannabis businesses; and (2) continuously monitor code enforcement activities performed for cannabis businesses in the City. The cannabis program enforcement activities conducted by the Housing and Dangerous Buildings were not part of this review.
We focused solely on activities related the Cannabis Code Enforcement Unit (CCEU) within the Neighborhood and Business Compliance Program. In performing our review, we interviewed CCEU Management to understand the business processes for the area under review, requested applicable
2 In addition to Chapter 5.150, Chapter 17.228 of the Sacramento City Code contains zoning and land use regulations for cannabis businesses.
Office of the City Auditor
Continuous Cannabis Monitoring 9
Cannabis Code Enforcement Unit (CCEU)
October 2022
policies and procedures and supporting documentation, observed fourteen cannabis business inspections, and reviewed cannabis code enforcement inspection and violation documents. We also performed analysis of cannabis code enforcement data in the City’s code enforcement software, CitizenServe. The scope of this review included all CCEU activities from the program’s inception, in July 2018, to June 2022.
Office of the City Auditor
Continuous Cannabis Monitoring 10
Cannabis Code Enforcement Unit (CCEU)
October 2022
Finding 1: Two Cannabis Businesses Were Not Being Regularly Inspected and Some Inspections Were Not Performed Timely
Inspections are an important tool for assessing compliance with applicable regulations and requirements. Inspections typically include a visit to a facility or site for the purpose of gathering information to determine whether it is in compliance. Inspections generally include pre-inspection activities, such as obtaining general site information, as well as on-site activities. On-site activities typically include interviewing facility representatives, reviewing records and reports, taking photographs, and observing facility operations.
3 As part of the inspection process, inspectors also
communicate with the businesses on the steps they need to take to achieve compliance.
As illustrated in the Background section, the CCEU conducts hundreds of periodic inspections of cannabis businesses annually. During our review, we identified two cannabis businesses that had been in operation for approximately 18 months but had not been regularly inspected by the CCEU due to a failure to create a new business file in the information system. Additionally, we found several periodic inspections that were not performed in accordance with the inspection schedule. Specifically, we found:
• Two cannabis businesses were operating without being regularly inspected; and • Six percent of cannabis business inspections we reviewed were not conducted in accordance with the established inspection schedule.
The CCEU has established an inspection schedule for cannabis businesses. As part of periodic inspection protocols, code enforcement officers review multiple cannabis regulations, including health and safety requirements. Without consistent periodic inspections performed in a timely manner, there is a greater risk of unidentified noncompliance leading to unsafe or illegal operating conditions. We recommend that the CCEU strengthen its controls over file creation in CitizenServe to ensure that all permitted businesses are being inspected on a regular basis and develop and implement a control procedure designed to identify untimely periodic inspections.
Two Cannabis Businesses Were Operating Without Being Regularly Inspected We tested whether the CCEU was actively monitoring compliance for all permitted cannabis businesses as of June 24, 2022. To perform our testing, we obtained a listing of active cannabis BOPs from the City’s business permitting system and reconciled the listing with data in CitizenServe to verify each permitted business had a corresponding CitizenServe business file and had been receiving compliance inspections.
In our review of 257 active cannabis BOPs, we identified two permitted cannabis businesses that did not
3 California Environmental Protection Agency. “How We Monitor Compliance.” US EPA, 22 June 2022, www.epa.gov/compliance/how-we-monitor-compliance.
Office of the City Auditor
Continuous Cannabis Monitoring 11
Cannabis Code Enforcement Unit (CCEU)
October 2022
have a corresponding CitizenServe business file. In other words, these businesses were open and operating and were not being regularly inspected by the CCEU.
We inquired with CCEU management to understand why these businesses were not being inspected and learned that the businesses received an initial inspection prior to issuance of the BOP, but a CitizenServe business file had never been created for these businesses. This is a key step in the inspection process because it drives the inspection schedule.
CCEU policies and procedures provide general guidance for entering inspection data in CitizenServe.
Their procedures state that, “Upon completion of an inspection or the issuance of a corrective notice, Code Officers shall create a case in Citizenserve (if a case does not exist for the subject cannabis site), and update the case accordingly with detailed case notes, photos, and all related documents.” Since this step was not completed, no regular inspections occurred for these two businesses.
We calculated how long these businesses were in operation without inspections. Our calculation showed that these two businesses were operating for an average of 18 months since their original permitting date without receiving an inspection from the CCEU. The following table shows the dates these businesses were permitted and the number of months they were in operation without regular inspection. When we brought this to the attention of CCEU management, they immediately conducted inspections for these two businesses on July 1, 2022 and did not find evidence of non-compliance.
Figure 5: Duration of Time that Cannabis Businesses were not Inspected Date of Active
Permit
Date of Initial
Inspection
Days w/o
Inspection
Months w/o
Inspection
Cannabis
Manufacturer 12/11/2020 7/01/2022 567 18.9
Cannabis
Distributor 1/25/2021 7/01/2022 522 17.4
Average time without inspection 18.2
Source: Auditor generated based on CitizenServe data.
The business names have been excluded from the figure for privacy purposes.
With the steady growth of the cannabis industry in Sacramento, it is important for the CCEU to be aware of all newly permitted cannabis businesses operating in the city. Failure to create a business file in CitizenServe for each permitted business may lead to cannabis businesses operating in the city without regulatory oversight. Furthermore, cannabis businesses that are not regularly inspected could engage in unsafe and illegal business practices. We recommend that the CCEU strengthen its controls over file creation in CitizenServe to ensure that all permitted businesses are inspected by the CCEU.
Office of the City Auditor
Continuous Cannabis Monitoring 12
Cannabis Code Enforcement Unit (CCEU)
October 2022
RECOMMENDATION
We recommend the Cannabis Code Enforcement Unit:
1. Strengthen its controls over file creation in CitizenServe to ensure that all permitted businesses are inspected by the CCEU.
Six Percent of Cannabis Business Inspections We Reviewed Were Not Conducted in Accordance with the Established Inspection Schedule
In our review of the CCEU’s policies and procedures, we learned that all cannabis businesses are to be inspected at regular intervals. However, we noted that no inspection interval was listed in the policy for cannabis manufacturing businesses. Through inquiry with CCEU management, we determined that manufacturing businesses are subject to 60-day inspection intervals. The following table provides an overview of the current inspection schedule for each type of cannabis business:
Figure 6: CCEU Inspection Schedule for Cannabis Businesses4 Cannabis Business Type Inspection Interval
Store-front Dispensary On or about every 30-days
Dispensary, Delivery-Only On or about every 30-days
Cultivation On or about every 60-days
Distribution On or about every 60-days
Microbusiness On or about every 60-days
Manufacturing On or about every 60-days
Source: Auditor generated based on CCEU Policies and Procedures (Modified 6/4/2020) and discussions with CCEU management.
Following our understanding of the CCEU’s inspection schedule, we reviewed a sample of cannabis business files in CitizenServe to determine whether periodic inspections were conducted according to the schedule. To do this, we isolated all periodic inspections from other enforcement activities and calculated the time between inspections. Due to the policy schedule allowing some flexibility in the timing (i.e., On or about every X-days) we allowed for an additional inspection period (30 to 90 days) beyond when a periodic inspection was due. We considered periodic inspections that fell beyond the additional period untimely for the purposes of our testing.
4 This CCEU inspection schedule is as of June 2022. In our review of periodic inspections, we used the CCEU inspection schedule that was in effect at the time of the inspection.
Office of the City Auditor
Continuous Cannabis Monitoring 13
Cannabis Code Enforcement Unit (CCEU)
October 2022
To perform our testing, we reviewed all periodic inspections for 35 randomly selected business files in CitizenServe. Our selection represented approximately 10 percent of the total population of cannabis business files in CitizenServe. We reviewed the entire file history for each business in our sample from the inception of the CCEU program, in July 2018, through our cutoff date of April 11, 2022. It is important to note that each business file contained multiple inspection activities that occurred during the review period. The results of our testing procedures indicated that 16 of 250, or 6 percent, of the periodic inspections we reviewed were untimely. Untimely periodic inspections observed ranged from 66 days to 431 days since the prior inspection. The following table summarizes the number of days for each untimely inspection.
Figure 7: Untimely Periodic Inspections Observed (out of 250 reviewed) Days Since Prior Inspection # of Periodic Inspections
90 days or less 2
91 - 180 days 10
181 - 360 days 3
Over 360 days 1
Total Untimely Inspections Identified 16
Source: Auditor generated based on CitizenServe data.
While the CCEU conducts hundreds of periodic inspections each year, untimely business compliance inspections may prevent issues from being identified in a timely manner. We recommend that the CCEU update its inspection schedule to include cannabis manufacturing businesses. We also recommend that management develop and implement a procedure designed to identify and address untimely periodic inspections.
RECOMMENDATION
We recommend the Cannabis Code Enforcement Unit:
2. Revise its inspection schedule to include cannabis manufacturing businesses.
3. Develop and implement a control procedure designed to identify and address untimely periodic inspections.
Office of the City Auditor
Continuous Cannabis Monitoring 14
Cannabis Code Enforcement Unit (CCEU)
October 2022
Finding 2: Inspection Processes Could be Strengthened with the Use of Checklists During the Inspection and by Having Written Standardized Practices
There are several benefits that using a checklist during an inspection can provide. Even with excellent training, personnel benefit from a checklist of items to evaluate what is being inspected, whether it be equipment, facilities, worksites, or processes. Properly structured checklists list items in the logical order they will be inspected, allowing personnel to simply go through the checklist without having to remember each item. Checklists also hold personnel and organizations accountable by documenting what they’ve inspected; documentation that also can be used to demonstrate regulatory compliance.5
The CCEU conducts cannabis business compliance inspections and follows up with cannabis businesses for identified code violations. As part of the inspection process, the CCEU observes the cannabis facility operations and reviews state and local operating requirements to determine compliance. We observed that while CCEU has developed checklists, they do not use them during the inspection and instead rely on training and memory of applicable regulations. Specifically, we found:
• Inspections are conducted without utilizing a checklist during the inspection; and • Inventory inspection procedures are informal and not documented.
When the CCEU does not use a checklist during the inspection, there is a greater risk that compliance requirements are overlooked. Additionally, without specific procedures for conducting inventory inspections, this may lead to variability in the way inspections are performed, which could reduce their effectiveness. We recommend that the CCEU use a checklist or similar tool while conducting inspections to ensure all applicable cannabis business regulations are reviewed. We also recommend that the CCEU standardize and document its procedures for conducting inventory inspections including how products are selected, what is reviewed, and how results are documented.
Inspections are Conducted Without Utilizing a Checklist During the Inspection Code enforcement officers in the CCEU primarily conduct business compliance inspections and follow up on identified code violations. The most common types of inspections conducted by the CCEU are business operating permit (BOP) walkthrough inspections and periodic compliance inspections. A BOP walkthrough inspection is an on-site inspection of the cannabis business facility, operating procedures, and security protocols to ensure that the cannabis business is compliant with cannabis business regulations. BOP walkthrough inspections are conducted prior to the business receiving a business operating permit from the Office of Cannabis Management (OCM). A periodic compliance inspection is
5 Macpherson, Shawn. “Six Best Practices for Auditing and Inspecting.” The Checker, www.thechecker.net/stories/blog/six-best-practices-for-auditing-and-inspecting. Accessed 12 July 2022.
Office of the City Auditor
Continuous Cannabis Monitoring 15
Cannabis Code Enforcement Unit (CCEU)
October 2022
an inspection of the cannabis business operations and facility to ensure that the business is still compliant with the City’s cannabis business regulations (City Code chapter 5.150). Periodic compliance inspections are conducted at regular intervals, such as every 30, 60, or 90 days.
Inspection Checklists
CCEU management compiled City and State regulations and developed inspection checklists to guide code enforcement officers through the applicable regulations while performing inspections. The CCEU’s policies and procedures describe checklists as Required paperwork, and state that code enforcement officers shall have these on their person when conducting inspections. Figure 8 shows an excerpt from their internal policies on the equipment to have on-hand while conducting inspections.
Figure 8: Excerpt from Cannabis Code Enforcement Unit Policies and Procedures
Source: CCEU Policies and Procedures (Modified 6/4/2020).
Prior to 2020, it was standard practice for code enforcement officers to manually complete paper checklists while conducting inspections and then scan them into CitizenServe for recordkeeping. In 2020, the CCEU converted the checklist to a digital format, to be completed electronically within the CitizenServe application. As a result of the change, code enforcement officers complete the digital checklist in the electronic system sometime after the inspection, using a laptop. Digital checklists improve efficiency because they can be generated in the CitizenServe business file without the need to scan documents. However, this new process does not comply with the CCEU policies and procedures, which states that inspectors should bring their checklist with them while they conduct the inspection.
Observation of CCEU Inspections
We observed the CCEU conduct fourteen compliance inspections at eleven different cannabis facilities between January 19, 2022, and January 31, 2022. The following table summarizes the types of inspections and cannabis businesses observed:
Office of the City Auditor
Continuous Cannabis Monitoring 16
Cannabis Code Enforcement Unit (CCEU)
October 2022
Figure 9: Summary of Auditor Observation of Inspections by Business Type Inspection Type /
Business Types
Storefront
Dispensary
Delivery-Only
Dispensary Cultivation Manufacturing Distribution Total BOP Walkthrough 1 1 2
Periodic 1 5 2 2 2 12
Source: Auditor generated
During the two BOP walkthrough inspections, we observed that code enforcement officers relied solely on their recollection of applicable cannabis regulations to conduct the inspections. A checklist or guidance document was not used during the inspection. We also observed twelve periodic compliance inspections for various types of cannabis businesses. During these inspections, we again observed that code enforcement officers relied primarily on their recollection of applicable cannabis regulations to conduct the inspection. No standard checklist or guidance document was used during the inspections to ensure all requirements were reviewed. Sometime after the physical inspection had been completed, code enforcement officers filled out the digital checklists in CitizenServe.
We reviewed the digital checklist after each inspection and noted that in all instances where a checklist was completed, code enforcement officers marked that they had reviewed all cannabis business regulations. However, we observed specific items on the checklists that the code enforcement officers did not review during the inspections. For example, we observed that code enforcement officers did not review compliance with 2 of 4 requirements
6 in the records section of the digital checklists they completed after the inspections. Figure 10 shows an excerpt from the digital checklist regarding compliance with records.
Figure 10: Excerpt from Digital Inspection Checklist
Source: CCEU Monthly Inspection Checklist
Missing steps in the inspection process shows the risk of not having the checklist on-hand during the inspection and instead relying on training and memory.
6 The requirements that we observed that were not reviewed by code enforcement officers were: (1) Date, time, amount, and price of transactions including business names, and (2) Employee records including date of hire and role/title.
Office of the City Auditor
Continuous Cannabis Monitoring 17
Cannabis Code Enforcement Unit (CCEU)
October 2022
Furthermore, code enforcement officers did not complete the digital checklist for three of the twelve periodic inspections. This further highlights one of the most significant risks of not using a checklist while performing the inspection, the inspection results may never be documented at all.
As part of our review, we studied the California Department of Alcoholic Beverage Control (ABC) practices for conducting inspections to determine whether they use a checklist during their inspections.
ABC has a dedicated enforcement program called IMPACT, whose primary goal is to reduce alcohol- related crime in and around licensed premises. The program’s major objectives are to: (a) Conduct visits and inspections of licensed premises; (b) Identify instances of non-compliance at licensed premises; (c) Take appropriate enforcement action on any major violations observed; and (d) Conduct follow up visits as needed to check for compliance. These tasks are similar in nature to the CCEU’s responsibilities. In reviewing IMPACT Inspection and Advisement, we determined that the IMPACT officers will use a checklist during inspections to ensure that all areas are reviewed, as well as to note any violations observed. The checklist is provided to the licensee along with educational materials on the code section violated. Licensees must then correct any problem areas.7
Conducting an inspection without a checklist on-hand increases the risk of overlooking compliance requirements. If requirements are overlooked, a business may be operating out of compliance for an extended period. Additional inspections and follow-up actions may be required to promote compliance.
Additionally, if complete documentation is not present, the City may not have sufficient evidence to demonstrate whether the business was reviewed and met the requirements. We recommend that the CCEU use a checklist during the inspection, in accordance with their policies and procedures, when conducting inspections to ensure all applicable cannabis business regulations are reviewed during each inspection.
RECOMMENDATION
We recommend the Cannabis Code Enforcement Unit:
4. Use a checklist in accordance with policies and procedures when conducting inspections to ensure all applicable cannabis business regulations are reviewed.
Inventory Inspection Procedures are Informal and Not Documented When improving business processes, it is essential to document the process and any improvements made to it. The most important reason for documenting any process is the fact that it reduces operational ambiguity. When there is confusion regarding who is supposed to do what, or what the best
7 “Business Inspections | Alcoholic Beverage Control.” California Department of Alcoholic Beverage Control, www.abc.ca.gov/prevention/business-inspections. Accessed 12 July 2022.
Office of the City Auditor
Continuous Cannabis Monitoring 18
Cannabis Code Enforcement Unit (CCEU)
October 2022
practices are for a task that needs to be performed, detailed documentation can be reviewed. These documents act as a store of collective organizational knowledge regarding business processes.8
CCEU Officers review cannabis business compliance with Sacramento City Code section 5.150.160 (A) which states “A cannabis business must maintain the following business records in printed format for at least three years on the site and must produce them to the city within 24 hours after receipt of the city’s request.” Subsection (A)(6) further specifies one of the document requirements as, “an inventory record documenting the dates and amounts of cannabis received at the site, the daily amounts of cannabis on the site, and the daily amounts of cannabis sold, distributed, and transported from the site.”
To test compliance with this section of the code, we observed officers arbitrarily select 2 or 3 cannabis products from the business’ inventory and validate the accuracy of the product count in the inventory management system. However, we observed that the results of these procedures are not documented in CitizenServe, even when there is an inventory discrepancy identified. We also observed inconsistencies in the quantity of items selected for reconciliation and the procedure for selecting items (i.e., the code enforcement officer selected the products in some instances and requested the business representative select the products in others).
In our inquiry with CCEU management, they noted that new inventory inspection procedures for cannabis cultivation facilities are being developed. They believe that the current process for reviewing inventory in cultivation facilities is insufficient since cultivators often have hundreds or thousands of plants in various stages of development located in multiple grow rooms. Plant identification relies on unique numbers and barcodes that correspond to the business’ inventory management system. They believe the new inventory procedures will need to be more robust to address the complexity of cannabis cultivation facilities. With this in mind, we suggest CCEU also apply the lessons learned from this review to these future inventory procedures.
Whether the CCEU is reviewing products on the shelf at cannabis retailers, or cannabis plants in grow rooms at cultivation facilities, it will be important to ensure that a review of a cannabis business’ inventory records is effective by standardizing and documenting its procedures for conducting inventory inspections including how products are selected, what is reviewed, and how results are documented.
8 “Documenting a Process - Importance and Its Benefits.” Management Study Guide, www.managementstudyguide.com/documentation-of-process.htm. Accessed 12 July 2022.
Office of the City Auditor
Continuous Cannabis Monitoring 19
Cannabis Code Enforcement Unit (CCEU)
October 2022
RECOMMENDATION
We recommend the Cannabis Code Enforcement Unit:
5. Standardize and document its procedures for conducting inventory inspections including how products are selected, what is reviewed, and how results are documented.
Office of the City Auditor
Continuous Cannabis Monitoring 20
Cannabis Code Enforcement Unit (CCEU)
October 2022
Finding 3: Some Cannabis Code Enforcement Data in Citizen Serve is Missing or Inconsistent
According to TechTarget, a global network of technology-specific websites, “Data quality is a measure of the condition of data based on factors such as accuracy, completeness, consistency, reliability and whether it's up to date. Measuring data quality levels can help organizations identify data errors that need to be resolved and assess whether the data in their IT systems is fit to serve its intended purpose.”
9 The CCEU utilizes CitizenServe as the primary application and database for recording cannabis code enforcement activities conducted. In our review of cannabis code enforcement data from the CitizenServe system, we noted inconsistencies in the quality of data within the cannabis business files. Specifically, we found:
• Documents and photographs were not always uploaded to CitizenServe following inspection observations in accordance with policies and procedures; • Evidence of business compliance for Issued Violations and Administrative Penalties is inconsistent; and
• Enforcement activities are not documented as completed in CitizenServe.
Incorrect or incomplete data can have significant business consequences. Poor-quality data is often the source of operational miscalculations, inaccurate analytics and ill-conceived business strategies.10 Based on our identification of cannabis business code enforcement data quality issues within CitizenServe, we recommend that the CCEU develop policies and procedures that provide standard guidance for complete and accurate documentation of cannabis business compliance files. We also recommend that the CCEU develop policies and procedures for following up on enforcement actions and establish a minimum standard for documenting enforcement actions and evidence of compliance following a violation. Finally, we recommend that the CCEU develop standards for data quality when inputting code enforcement data in CitizenServe.
Documents and Photographs Were Not Always Uploaded to CitizenServe following Inspections in Accordance with Policies and Procedures
According to Comcate, a software company that specializes in local government, “A code enforcement program is only as good as the documents show. This principle is especially critical when a municipality must respond to an inquiry or to an enforcement action. When inquiries are conducted, investigators often place significant weight on the value of documents that record facts and public record requests.
9 Vaughan, Jack. “Data Quality.” TechTarget, 1 Nov. 2019, www.techtarget.com/searchdatamanagement/definition/data-quality. 10 Vaughan, Jack. “Data Quality.” TechTarget, 1 Nov. 2019, www.techtarget.com/searchdatamanagement/definition/data-quality.
Office of the City Auditor
Continuous Cannabis Monitoring 21
Cannabis Code Enforcement Unit (CCEU)
October 2022
When a code enforcement officer has to document the reasons for a specific action, a documentation requirement promotes consistency and critical thinking, and analysis. A documentation program also promotes protection against potential disputes or inquiries in the future. The existence of a document can be critical to protecting a municipality from litigation.”11 Photographs Were Not Uploaded to CitizenServe After an Inspection CCEU’s Cannabis Code Enforcement policies state that upon completion of an inspection code enforcement officers shall update the CitizenServe business file “with detailed case notes, photos, and all related documents.” An excerpt from the policy is provided here:
Figure 11: Excerpt from Cannabis Code Enforcement Unit’s Policies and Procedures
Source: CCEU Policies and Procedures (Modified 6/4/2020).
Following our observation of fourteen compliance inspections between January 19, 2022, and January 31, 2022, we reviewed the corresponding files in CitizenServe to determine whether the inspections had been documented in accordance with policies and procedures. We reviewed compliance inspection notes and confirmed whether documents and photographs for each inspection had been uploaded to the business file. For one of the two BOP walkthrough inspections, we observed the code enforcement officer take photographs during the inspection, however, the photographs were not uploaded to CitizenServe to document the inspection.
Additional Testing of Inspection Documentation in CitizenServe In addition to observing inspections, we performed data analytics testing using cannabis code enforcement data from CitizenServe. To perform our testing, we obtained all historical cannabis code enforcement data within CitizenServe from the initiation of the program in July 2018 through April 2022 and performed a review and analysis of the data. We determined that there were 340 active cannabis business files in CitizenServe. To test the data, we selected a sample of approximately 10 percent of the business files and reviewed all of the enforcement activities in the business file for completeness and
11 Laskowski, Cara. “Best Practices: Implementing a Proactive Code Enforcement Program.” Comcate, 28 Feb. 2022, www.comcate.com/blog/best-practices-implementing-a-proactive-code-enforcement-program.
Office of the City Auditor
Continuous Cannabis Monitoring 22
Cannabis Code Enforcement Unit (CCEU)
October 2022
accuracy. Our review involved determining whether all required photos and documents had been uploaded to support the activities, as well as whether the activities had been marked as completed. We also reviewed enforcement activity notes for reasonableness.
In our testing of enforcement activities (e.g., inspections, re-inspections, violations, penalties, etc.) in CitizenServe, we determined that 30 of 485 activities, or approximately 6 percent, were missing required documents (e.g. inspection checklist, BOP Form, or photographs). We also determined that 5 of 485 activities reviewed, or 1 percent, were missing required business file notes. The following table summarizes the types of missing documentation:
Figure 12: Summary of Missing Documentation Observed
Type of Missing
Documentation
# of Enforcement
Activities Missing
Documentation
Total Enforcement
Activities Reviewed
(%) of Enforcement
Activities Missing
Documentation
Inspection Documents 30 485 6 %
File Notes 5 485 1 %
Source: Auditor generated based on CitizenServe data
We reviewed CCEU policies and procedures and found they had limited guidance for how inspection activities should be documented in CitizenServe. Without a standard for proper documentation of business compliance inspections, the risk of missing documentation and incomplete business files is increased. To mitigate this risk, we recommend that the CCEU update their policies and procedures to provide more specific guidance to code enforcement officers on the standard for documenting inspection activities in CitizenServe.
RECOMMENDATION
We recommend the Cannabis Code Enforcement Unit:
6. Update policies and procedures to provide more specific guidance for complete and accurate documentation of cannabis business compliance files.
Evidence of Business Compliance for Issued Violations and Administrative Penalties is Inconsistent
Information stored in documents and records is critical to the functioning of a business. Best practices for documentation and recordkeeping aim to preserve the data integrity of important documents and records and serve as guidelines for how to record information and store data appropriately.12 For
12 “Good Documentation Practices: Recordkeeping Rules That Everyone Should Follow.” Safety Culture, 28 Apr. 2022, safetyculture.com/topics/good-documentation-practices.
Office of the City Auditor
Continuous Cannabis Monitoring 23
Cannabis Code Enforcement Unit (CCEU)
October 2022
example, the City of Sacramento Code Compliance Division’s Standard Operating Procedures for Field Inspections instructs code enforcement officers to take notes and photographs to document any violations observed.13 Additional guidance includes the following:
a. Case notes must be entered into CitizenServe within 24-48 hours after inspection was conducted.
b. Case notes shall include the following:
1. Date and time of inspection.
2. Name of resident or property owner if contact was made.
3. Description of the property inspected.
4. Violations observed and where on the property the violations are located.
In our review of the CCEU, we performed testing on Notice of Violations (NOVs) and administrative penalties issued since the establishment of the CCEU in 2018. A NOV is a formal notification from the City that the business is not in compliance with the City’s cannabis business regulations. The NOV instructs the business to correct a specific issue within a specified timeframe or the business will incur an administrative penalty. An administrative penalty is also a formal notification of noncompliance but also imposes a monetary penalty on the business. We obtained all cannabis code enforcement data within CitizenServe as of April 11, 2022 and performed a review and analysis of NOV and administrative penalty data. Figure 13 summarizes the NOVs, and administrative penalties issued between 2018 and 2021.
13 Refer to section 20.04 “Field Inspections – Initial Inspection” of the Code Compliance Division’s Standard Operating Procedures, and sub-sections (3)(d)(7) and (3)(e).
Office of the City Auditor
Continuous Cannabis Monitoring 24
Cannabis Code Enforcement Unit (CCEU)
October 2022
Figure 13: Summary of Notice of Violations and Administrative Penalties by Year
Source: CitizenServe Report Data – “Department equals Cannabis” (as of April 11, 2022)
We first reviewed the data at a high level to identify trends and outliers. We observed that there were considerably more NOVs issued than administrative penalties in 2020 and 2021. According to CCEU, NOVs are typically issued prior to an administrative penalty. The greater volume of NOVs could indicate that the NOV process is effective in promoting compliance and reduces the need for administrative penalties. It may also indicate that issued NOVs are not followed up on to determine if violations are addressed. From the data, we observed that zero NOVs were issued in 2019. We inquired with CCEU management about this and learned that the CCEU chose to take primarily an educational approach with cannabis businesses in 2019. Rather than issue NOVs, the CCEU aimed to educate businesses on cannabis rules and regulations before it moved to an enforcement phase in 2020. Finally, we observed many of the penalties and violations in the data did not have a date of completion, which is why there is a data category in the chart above without a date (i.e. blank column). We address the issue of completed inspection activities in the next subfinding.
After reviewing the data from a high level, we examined each instance of a violation or penalty in CitizenServe to understand the conditions for each enforcement action. We reviewed case notes and applicable documents to validate that the violation or penalty was followed up on until compliance was achieved. In our detailed review of violations, we were unable to determine whether compliance was achieved due to insufficient documentation for 15 of 62, or 24 percent, of the NOVs reviewed.
Additionally, we were unable to determine whether compliance was achieved due to insufficient documentation for 8 of 23, or 35 percent, of administrative penalties reviewed. The following pie charts (blank) 2019 2020 2021
CANNABIS - NOTICE OF VIOLATION 1 23 30
CANNABIS - ADMIN PENALTY 14 2 4 2
0 5
10 15
20 25
30 35
Cannabis NOVs and Penalties by Year
CANNABIS - NOTICE OF VIOLATION CANNABIS - ADMIN PENALTY
Office of the City Auditor
Continuous Cannabis Monitoring 25
Cannabis Code Enforcement Unit (CCEU)
October 2022
illustrate the percentage of enforcement actions that we were not able to validate based on the lack of documentation.
Figure 14: Documentation Testing for Notice of Violations and Administrative Penalties
Source: Auditor generated based on CitizenServe records.
As noted above, best practices for code enforcement documentation include case notes that contain relevant details about the inspection. For the CCEU, this would include how the business achieved compliance, including when a reinspection occurred, details of communication with the business regarding compliance status, and documentation to support compliance. Files that we concluded had insufficient evidence of compliance contained notes that were too generalized; they did not include specific information on how the business became compliant. In some cases, enforcement actions were not followed up with notes or documented re-inspections to confirm that compliance was achieved.
When a NOV or penalty is issued to a cannabis business, it is an action designed to notify and encourage compliance with applicable business regulations. Equally as important as issuing the NOV, is the process for following up on the action to determine whether the business has taken steps to become compliant.
Without a thorough follow-up process, issues of noncompliance may not be remedied. For administrative penalties, an option exists to appeal the penalty and have a hearing on the matter. It is important that follow-up, supported by documentation, is completed to ensure that management can verify that the follow-up has been conducted in accordance with their expectations. We recommend that the CCEU develop policies and procedures for following up on enforcement actions and establish a minimum standard for documenting evidence of business compliance.
35%
65%
Administrative Penalty
Insufficient Documentation
Documentation Satisfactory
24%
76%
Notice of Violation
Insufficient Documentation
Documentation Satisfactory
Office of the City Auditor
Continuous Cannabis Monitoring 26
Cannabis Code Enforcement Unit (CCEU)
October 2022
RECOMMENDATION
We recommend the Cannabis Code Enforcement Unit:
7. Develop policies and procedures for following up on enforcement actions and establish a minimum standard for documenting evidence of compliance.
Some Enforcement Activities Were Not Documented as Completed in CitizenServe Many organizations today are plagued by poor data quality management, which in turn, leads to poor decision-making ability. Data quality is the degree to which data is error-free and able to serve its intended purpose. Certain properties of data contribute to its quality. Data must be:
• Accurate
• Up to date
• Complete with data in every field unless explicitly deemed optional • Unique so that there is only one record for a given entity and context • Formatted the same across all data sources
• Trusted by those that rely on the data
When organizations achieve consistently high-quality data, they are better positioned to make strategic business decisions that yield valuable business insights. 14 In our analysis of cannabis code enforcement data in CitizenServe, we reviewed various types of code enforcement activities to identify trends and outliers. Code enforcement activities are distinct events created in CitizenServe by the CCEU when an enforcement activity takes place. Enforcement activities included periodic inspections, BOP walkthrough inspections, notice of violations, administrative penalties, and other activities. Best practices suggest that when the enforcement activity is completed, the activity should be marked as “closed” or “completed” to indicate that it is no longer an open item. In our analysis of 4,268 cannabis code enforcement activities as of April 11, 2022, we identified 78, or approximately 2 percent, that were not closed, or marked as completed.
While we did not investigate every instance where an enforcement activity was not completed, some of the enforcement actions we reviewed had been completed by code enforcement officers but were not marked as such in CitizenServe. Completing an enforcement activity in CitizenServe allows management and auditors to review data and determine whether there are open enforcement actions that need to be addressed, and if inspections are conducted timely, without having to review each business file.
Without accurate and complete data, management will be limited in their ability to make critical
14 Talend. “10 Data Quality Best Practices | Talend.” Talend - A Leader in Data Integration & Data Integrity, www.talend.com/resources/data-quality-best-practices. Accessed 13 July 2022.
Office of the City Auditor
Continuous Cannabis Monitoring 27
Cannabis Code Enforcement Unit (CCEU)
October 2022
business decisions based in information gained from a review of code enforcement data. We recommend that the CCEU develop a process to ensure completed inspections are marked as closed in CitizenServe.
RECOMMENDATION
We recommend the Cannabis Code Enforcement Unit:
8. Develop a process to ensure completed inspections are marked as closed in CitizenServe.
Office of the City Auditor
Continuous Cannabis Monitoring 28
Cannabis Code Enforcement Unit (CCEU)
October 2022
Finding 4: Management Could Promote Efficiency and Effectiveness Through the Use of Performance Metrics and Documented Reviews
A performance metric is a set of quantitative data used to track operations inside a company using activities, employee behavior, and productivity as important indicators. These metrics track and measure the achievement of an organization’s goals. Keeping track of these performance indicators helps organizations establish strategies to meet objectives since it provides significant insight into what is working. Monitoring performance metrics may help businesses prepare for improvements, modifications, and changes to their operations to achieve their objectives.15
In discussing business objectives with the CCEU, we noted that management has not established any performance metrics to use for measuring achievement of goals. We also learned that the CCEU regularly reviews the quality of inspection work, but these reviews are informal and not documented to identify how they affect program quality. Additionally, we noted that the CCEU is not formally tracking critical safety assets. Specifically, we found:
• The cannabis code enforcement unit has not established performance metrics; • Supervisory review of inspection work is informal and not documented; and • Safety assets are not tracked or periodically reconciled.
As noted above, developing and tracking performance metrics is useful for ensuring that an organization is meeting its business objectives and helps businesses adapt to their changing operating environment.
Without utilizing a best practice, such as performance metrics or documentation of reviews, CCEU management may not be aware of systemic issues that are preventing achievement of goals. We recommend that the CCEU establish performance metrics to evaluate the effectiveness of the cannabis code enforcement program. We also recommend that the CCEU formalize supervisory review procedures in departmental policies and procedures and document results of supervisory reviews to determine effectiveness. Finally, we recommend that management implement a formal method for tracking equipment and safety gear to ensure it complies with applicable safety standards.
The Cannabis Code Enforcement Unit has not Established Performance Metrics Performance metrics are data used to track processes and evaluate performance within a business. This is achieved using activities and productivity as key metrics. This is in relation to an established goal such
15 Indeed. “What Is a Performance Metric? 4 Types to Use for Your Team.” Indeed Career Guide, ca.indeed.com/career-advice/career-development/performance-metric. Accessed 5 Aug. 2022.
Office of the City Auditor
Continuous Cannabis Monitoring 29
Cannabis Code Enforcement Unit (CCEU)
October 2022
as employee productivity or sales objectives. Performance metrics are a key tool for management to improve operations and streamline business processes.16
The CCEU’s program goal is “to regulate commercial cannabis operations in a manner which is consistent with local and state law and to protect the health and safety of the residents of the City of Sacramento.” Based on our discussions with the CCEU, we learned that internal CCEU policies and procedures were developed with limited industry guidance or prior knowledge because the cannabis industry is relatively new. Since then, the process of developing the cannabis code enforcement program has been one of trial and error, with management attempting to design inspection procedures that align with a changing regulatory environment, while simultaneously developing inspection protocols for a cannabis industry that does not have well established best practices. As a result, CCEU business processes are changed regularly to align with a changing regulatory environment while attempting to achieve operational objectives.
Performance measures are already a part of many of the City’s vital operations. For example, as part of the City’s annual budget, City departments publish performance measures that provide the public with information about how the City is doing in delivering key services. We noted that CCEU could benefit from developing key metrics to evaluate their program’s performance. While performance measures for smaller programs like the CCEU is not required, establishing performance metrics is a best practice and will assist management with understanding the CCEU’s effectiveness in a constantly changing environment. Performance measures also provide data for strategic decision making. We recommend that the CCEU establish performance metrics to evaluate program performance.
RECOMMENDATION
We recommend the Cannabis Code Enforcement Unit:
9. Establish performance metrics to evaluate the effectiveness of the cannabis code enforcement program.
Supervisory Review of Inspection Work is Informal and Not Documented Control activities are tools - both manual and automated - that help reduce the risks of error and improve effectiveness. According to COSO, a globally recognized authority on internal controls and risk, management should establish control activities that aid in accomplishing the organization’s objectives.17
16 FreshBooks. “What Are Performance Metrics? Definition and Examples.” FreshBooks, 20 May 2022, www.freshbooks.com/hub/productivity/performance-metric. 17 “Improving Organizational Performance and Governance.” Committee of Sponsoring Organizations of the Treadway Commission (COSO), COSO, Feb. 2014, www.coso.org/Shared%20Documents/Improving-Organizational- Performance-and-Governance.pdf.
Office of the City Auditor
Continuous Cannabis Monitoring 30
Cannabis Code Enforcement Unit (CCEU)
October 2022
Supervisory review is a control activity that helps to ensure policies are followed and data quality is maintained. Ultimately, supervisory review is the last line of defense in identifying any discrepancies or errors before CCEU’s inspection documents and data fields are considered finalized. It also alerts management when employees deviate from established procedures so that this can be addressed.
In our interviews with CCEU management, management stated that they regularly review cannabis code enforcement actions in CitizenServe to determine whether code enforcement officers are properly entering the required data. The review also serves to determine if the quality of case documentation is sufficient to meet legal requirements. Management stated that when they perform this review, these are the types of things they look for:
• Inspection activities have been added to the case notes; • Notes are accurate and completely describe the inspection details with proper grammar; • Documents and photographs (if applicable) have been uploaded to the case file; • Photographs (if applicable) clearly represent the relevant subject matter; and • Electronic checklist has been completed accurately with inspection details and forwarded to the cannabis business for review.
However, this supervisory review is not documented and there is no standard procedure or guidance for performing this review. Therefore, we were not able to validate that the reviews are occurring or evaluate the quality of the review process.
Due to the lack of documentation, we were unable to review or validate the effectiveness of the supervisory review procedure. Without a standardized approach and documented results for the supervisory review of cannabis code enforcement cases in CitizenServe, management will be limited in its ability to evaluate whether there are systemic issues that require additional attention or whether additional staff training is needed. We recommend that the CCEU formalize supervisory review procedures in departmental policies and procedures and document the results of supervisory reviews.
RECOMMENDATION
We recommend the Cannabis Code Enforcement Unit:
10. Formalize supervisory review procedures in departmental policies and procedures and ensure results of supervisory reviews are documented.
Safety Assets are not Tracked or Periodically Reconciled CCEU Officers routinely inspect cannabis facilities that use hazardous materials in the production of cannabis. As a matter of safety and to comply with various regulations, CCEU Officers are issued safety
Office of the City Auditor
Continuous Cannabis Monitoring 31
Cannabis Code Enforcement Unit (CCEU)
October 2022
gear to use when needed to protect themselves against these harmful materials. As it is vital, safety gear should be tracked and routinely tested to ensure it is ready for use or replaced when worn out.
Asset tracking is a systemized approach to managing and monitoring physical assets and can involve anything from simple inventory management to more complex systems that use sensors and technology to track the location of assets in real-time. Asset tracking helps businesses to become more efficient by reducing the amount of time spent searching for assets and by improving inventory management. When physical assets are properly tracked, businesses know exactly where their assets are located and can easily retrieve them when needed. In addition, asset tracking can help businesses to reduce losses due to theft or damage. By keeping track of physical assets, businesses can quickly identify when an asset is missing or has been damaged.18
As part of our review, we requested a listing of physical assets used by the CCEU and determined that the value of physical assets used by the CCEU for conducting inspections is approximately $25,000. We observed that code enforcement officers use standard equipment while performing inspections. The CCEU’s policies and procedures describe the equipment issued to each officer, as well as specialized safety gear that is readily available for use in special circumstances. Safety equipment includes ballistic vests, gas masks, carbon dioxide monitors, and 2-way radios. In discussing how management tracks and controls these assets, we determined that management does not track or reconcile any physical assets that it uses.
Code Enforcement Officers with the CCEU often inspect cannabis manufacturing and cultivation facilities that may utilize hazardous materials in the production of cannabis products. In other instances, code enforcement officers investigate illegal cannabis operations where there is a higher risk of violence.
Ensuring that all physical assets, especially safety equipment, is tracked and available for use is important in maintaining the safety and well-being of code enforcement officers. Additionally, recent state legislation called SB 296 requires that every city or county that employs code enforcement officers must develop safety standards that are specific and appropriate to the threats they face in their jurisdiction. To ensure that the CCEU has all of the required safety equipment to meet the standard adopted by the City, in accordance with SB 296, we recommend that the CCEU implement a formal method for tracking equipment and safety gear to ensure it complies with the City’s standards for safety.
18 Treybig, Kasey. “What Is Physical Asset Tracking - Fixed Asset Tracking.” Radiant, 18 May 2022, radiantrfid.com/blog/what-is-physical-asset-tracking.
Office of the City Auditor
Continuous Cannabis Monitoring 32
Cannabis Code Enforcement Unit (CCEU)
October 2022
RECOMMENDATION
W
e recommend the Cannabis Code Enforcement Unit:
11. I
mplement a formal method for tracking equipment and safety gear to ensure it complies with applicable safety standards.
Community Development Department
Code Compliance Division
300 Richards Blvd, 3rd floor
Sacramento CA 95838
33 DATE: August 25, 2022
TO: Office of the City Auditor
ATTN: Nathan Lugo, City Auditor
FROM: Peter Lemos, Code and Housing Enforcement Chief
RE: Response to Audit of the Cannabis Code Enforcement Unit I
NTRODUCTION
The Cannabis Code Enforcement Unit (CCEU) was established to assist the Office of Cannabis Management (OCM) with the enforcement of regulations adopted by the City of Sacramento for commercial cannabis. The CCEU is managed by a Senior Code Enforcement Officer and supported by two Code Enforcement Officers. In accordance with the City Auditor’s 2022/23 Audit Plan, the City Auditor completed an audit of the CCEU.
The audit identified four specific findings and made eleven recommendations. This memorandum responds to the findings and recommendations of the audit.
RESPONSES
FINDING 1: Two cannabis businesses were not inspected, and some inspections were not performed timely.
RECOMMENDATION 1: The CCEU strengthen its control over file creation in Citizenserve to ensure that all permitted businesses are inspected by the unit.
RESPONSE: To avoid this from happening, the CCEU now requires a Citizenserve case number on the Business Operational Permit (BOP) Inspection Checklist. This change ensures that a Citizenserve case is created for every BOP inspection conducted. The inspecting code enforcement officer is responsible for the creation of the Citizenserve case. The BOP inspection checklist is not considered complete until the case number is provided. These steps will also prevent from allowing a cannabis business to operate without an inspection from the CCEU.
These changes went into effect as of July 12, 2022.
RECOMMENDATION 2: Revise its inspection schedule to include all cannabis business types operating in the City.
RESPONSE: Inspections for all cannabis case types in Citizenserve are scheduled manually by the case manager. Inspections of manufacturing, distribution, testing laboratory, cultivation and micro businesses are scheduled for every 60 days. Dispensary and delivery retail businesses are scheduled for every 30 days.
To ensure that all cannabis case types are scheduled for an inspection, the CCEU will submit a formal request to the Information Technology Division to conduct automated scheduling based on case type. The automation will reduce human error and increase accountability and the completing of scheduled inspections. The request will be submitted by September 1, 2022.
RECOMMENDATION 3: Develop and implement a control procedure designed to identify untimely periodic inspections.
Community Development Department
Code Compliance Division
300 Richards Blvd, 3rd floor
Sacramento CA 95838
34 R
ESPONSE: The Neighborhood Code Unit (NCU) utilizes an integrated metric system developed by Citizenserve. The metric provides a list of inspections scheduled by case type and due date.
The metric system groups all scheduled inspections into 3 categories and by case type. The categories include:
• 14 days or less
• 15 – 30 days or less
• 90 days or more
The intent of the metric is to assist code enforcement officers with case management. The same metric can be applied to the cannabis module. The CCEU submitted a formal request to the Information Technology Division on August 16, 2022, to create a similar metric for the cannabis cases.
F
INDING 2: The inspection process could be strengthened with the use of checklists and standardized practices.
RECOMMENDATION 4: Use a checklist or similar tool when conducting inspections to ensure all applicable cannabis business regulations are reviewed.
RESPONSE: On August 7, 2022, the CCEU received Dell Latitude 7220 series tablets and are required to utilize them when completing inspections of all cannabis businesses. The tablet allows the inspecting code enforcement officer to complete a digitized inspection checklist integrated into Citizenserve. The checklist can be completed as the inspection is conducted.
Each case type has a customized checklist with requirements specific to the case type to all applicable requirements are reviewed with the business owners.
RECOMMENDATION 5: Standardize and document its procedures for conducting inventory inspections including how products are selected, what is reviewed, and how results are documented.
RESPONSE: The CCEU will prioritize the development and implementation of policy and procedures that will outline how to execute inventory inspections, how to select the inspection of certain cannabis products, and the proper documentation of its findings upon completion of all inspections. Policies and procedures will be in place for each of the areas identified by the Auditor’s Office by January 1, 2023.
F
INDING 3: Some cannabis code enforcement data is missing or incomplete.
RECOMMENDATION 6: Develop policies and procedures that provide standard guidance for complete and accurate documentation of cannabis business compliance files.
RESPONSE: The CCEU will prioritize the development and implementation of policies and procedures to provide code enforcement officers with standard guidelines on the complete and accurate documentation of cannabis business compliance files. A brief policy is currently in place but requires incorporation of best practices relating to documentation of findings. The code enforcement officers assigned to the CCEU will attend trainings provided by the California Association of Code Enforcement Officers on documentation and evidence gathering. A policy will be in place by no later than November 1, 2022.
Community Development Department
Code Compliance Division
300 Richards Blvd, 3rd floor
Sacramento CA 95838
35 RE
COMMENDATION 7: Develop policies and procedures for following up on enforcement actions and establish a minimum standard for documenting evidence of compliance.
RESPONSE: The CCEU will prioritize the development and implementation of policy and procedures that will outline how to execute inventory inspections, how to select the inspection of certain cannabis products, and the proper documentation of its findings upon completion of all inspections. The code enforcement officers assigned to the CCEU will attend trainings provided by the California Association of Code Enforcement Officers on documentation and evidence gathering. A policy will be in place by no later than November 1, 2022.
RECOMMENDATION 8: Develop a process to ensure completed inspections are marked as closed in CitizenServe.
RESPONSE: Cannabis cases in Citizenserve are used as inventory and do not close. However, an “activity” is assigned to a code enforcement officer and must be closed to be completed. A formal request to the Information Technology Division was submitted on August 16, 2022, for a report that list the following:
A. All cannabis cases with an open (not yet completed) activity B. All cannabis cases with an activity that is past due the date scheduled for completion
FINDING 4: Management could promote efficiency and effectiveness through the use of performance metrics and documented reviews.
RECOMMENDATION 9: Establish performance metrics to evaluate the effectiveness of the cannabis code enforcement program.
RESPONSE: The City’s Information Technology Division is in final stages of providing a Request for Proposal (RFP) for a more robust database that will provide the ability to gather data and provide statistical reports to help establish performance metrics and better evaluate the effectiveness of the cannabis code enforcement program. The intent is to have the cannabis program mirror metrics and performance standards set for the Neighborhood Code Unit relating to inspections, enforcement activities (e.g., administrative fines, corrective action notices, etc.), and overall time invested in the inspection of various cannabis business types.
RECOMMENDATION 10: Formalize supervisory review procedures in departmental policies and procedures and ensure results of supervisory reviews are documented.
RESPONSE: The CCEU will document and formalize the review process. The reviews will be completed by a Senior CEO or higher. The review process will also require documentation of outcomes and provide training to CEOs as needed.
RECOMMENDATION 11: Implement a formal method for tracking equipment and safety gear to ensure it complies with applicable safety standards.
RESPONSE: The Code Compliance Division is working on redesigning storage area for the safe keeping and tracking of safety equipment for each unit including the CCEU. It will provide storage, lockers for code enforcement staff, and the ability to track equipment that is issued, damaged or needs to be replaced. The storage area should be in place by January 1, 2023.
Office of the City Auditor
Continuous Cannabis Monitoring 36
Cannabis Code Enforcement Unit (CCEU)
October 2022
Appendix
BOP Final Walkthrough Evaluation Form (BOP Form)