Audit of the Cannabis Control Commission (August 14, 2025)
August 14, 2025 · Cannabis Control Commission · Read the full official report on mass.gov ↗
Published August 14, 2025 Audit covers July 1, 2022 – June 30, 2024; employee settlement agreements extended to January 1, 2019 through December 31, 2024 Under Diana DiZoglio · 2023–present
source
“Below is a summary of our findings, the effects of those findings, and our recommendations, with hyperlinks to each page listed.”
Read the plain-English breakdown
This is a state performance audit of the Massachusetts Cannabis Control Commission, covering mostly July 1, 2022 through June 30, 2024, with a longer lookback for employee settlements.
“In accordance with Section 12 of Chapter 11 of the Massachusetts General Laws, the Office of the State Auditor has conducted a performance audit of the Cannabis Control Commission (CCC) for the period July 1, 2022 through June 30, 2024.”
The auditor checked whether the commission properly handled cannabis fees and fines, reviewed host community agreements and community impact fees, and followed proper practices for employee settlement agreements.
“The purpose of our audit was to determine whether CCC administered the calculation, collection, and accounting for fees and fines collected in the marijuana regulation fund (MRF) in accordance with Sections 5 and 13 of Chapter 94G of the General Laws and Sections 500.005(1)(d) and 500.360(2) and (3) of Title 935 of the Code of Massachusetts Regulations (CMR).”
The report says these problems affect public trust, fairness to cannabis businesses, state revenue, public health oversight, and the commission’s ability to regulate the industry reliably.
“Proper collection of fees, penalties, and fines, as well as consistent review of HCAs, are critical to CCC’s mission.”
For an ordinary resident, this matters because weak oversight can mean lost public money, uneven treatment of businesses, delayed action on unsafe or noncompliant cannabis operations, and less confidence in a state regulator.
“Lengthy timeframes, especially around enforcement action, put customers at potential risk either of purchasing and consuming contaminated or expired marijuana products or of being exposed to other public health risks.”
The auditor concluded that the commission did not meet all of the audit objectives, especially for fees and fines, host community agreements, settlement processes, and internal controls.
“Below is a list of our audit objectives, indicating each question we intended our audit to answer; the conclusion we reached regarding each objective; and, if applicable, where each objective is discussed in the audit findings.”
The auditor recommended fixes such as collecting unpaid fees, setting written procedures and timelines, reviewing host community agreements, creating settlement policies, improving staffing and controls, and reconciling payments more regularly.
“As part of our post-audit review process, we will follow up on these matters in approximately six months.”
The report is significant because it describes broad operational failures at the state agency responsible for regulating cannabis in Massachusetts, not just isolated paperwork mistakes.
“The absence of documented controls over the areas reviewed during our audit may indicate broader organizational risks, particularly given CCC’s wide range of statutory responsibilities in regulating the cannabis industry in the Commonwealth.”
A host community agreement is a deal between a city or town and a cannabis business operating there; it can include a community impact fee, but the report says some agreements included terms that were not allowed.
“Section 3 of Chapter 94G of the General Laws empowers communities to impose reasonable safeguards on the operation of marijuana establishments in the form of ordinances, bylaws, and host community agreements (HCAs) between a municipality and individual marijuana establishments operating in that municipality.”
10 figure(s) pending source verification - not shown
What the Auditor checked
- Did not comply Did CCC administer the calculation, collection, and accounting for fees and fines collected in the marijuana regulation fund (MRF) on an equitable basis and in accordance with Sections 5 and 13 of Chapter 94G of the General Laws and Sections 500.005(1)(d) and 500.360(2) and (3) of Title 935 of the Code of Massachusetts Regulations (CMR)?
- Did not comply Did CCC review, approve, and certify host community agreements (HCAs) and Community Impact Fees (CIFs) in accordance with 935 CMR 500.180(2)–(4)?
- Did not comply Did CCC follow a process—dating back to January 1, 2019—that was in compliance with the Office of the Comptroller of the Commonwealth’s (CTR’s) “Settlements and Judgments Policy” when determining whether to enter into, and when reviewing and finalizing, employee settlement agreements?
What the Auditor found
Why it matters: The Commonwealth lost fee revenue, licensees were treated inequitably, and the process created an appearance of potential impropriety that could erode public trust.
Standard: Section 6(a) of Chapter 94G of the General Laws and 935 CMR 500.103(4)(a). ( Section 6(a) of Chapter 94G of the General Laws; 935 CMR 500.103(4)(a) )
4 recommendations
- CCC should conduct a full reconciliation to identify the total population of all uncollected license extension fees.agency: agreed
- CCC should implement a standardized, written procedure for administering license extensions to ensure equity and compliance with applicable regulations.agency: already implemented
- CCC should prioritize adequate staffing, oversight, and automation of the billing process for license extension fees.agency: partially agreed
- CCC should update its procedures to ensure that they are demonstrably fair, equitable, and transparent to help increase the public’s trust and prevent the appearance of potential impropriety.
Agency response & Auditor reply
Auditor: "Based on CCC’s response, it has been taking steps to address the concerns expressed in this finding."
Why it matters: Delayed enforcement may have allowed compliance issues to persist, undermined regulatory effectiveness, created inequity, posed public health risks, and compromised due process.
Standard: CCC Notice of Deficiency Process, 935 CMR 500.320, 935 CMR 500.360, and 935 CMR 500.500. ( 935 CMR 500.320; 935 CMR 500.360; 935 CMR 500.500 )
2 recommendations
- CCC should establish, document, and follow specific timelines for the assessment and collection of fines throughout all phases of its inspection process.agency: disagreed
- CCC should designate a hearing officer pursuant to its regulations.agency: already implemented
Agency response & Auditor reply
Agency: "The calculations of the average time for each step of the investigation and enforcement process are overly simplistic and fail to consider important parts of the process."
Auditor: "Our finding is that fines were not assessed and collected in established timeframes."
Why it matters: Noncompliant agreements imposed undue financial burdens on small businesses and could favor larger, often out-of-state operators.
Standard: Section 3(d)(2)(i) of Chapter 94G of the General Laws. ( Section 3(d)(2)(i) of Chapter 94G of the General Laws )
1 recommendation
- CCC should review all existing HCAs to ensure that they do not contain noncompliant terms.agency: disagreed
Agency response & Auditor reply
Agency: "All new license and renewal applications since March 1, 2024, have included review and approval of HCAs for statutory compliance and all Post Provisional License inspections have required a statutorily complaint HCA since March 1, 2024."
Auditor: "Our finding is that upon obtaining regulatory authority, effective March 1, 2024, CCC failed to proactively review existing HCAs and delayed implementation of the new HCA review process even after the new regulations passed."
Why it matters: CCC could not ensure employee settlements were handled equitably, ethically, legally, and consistently, especially when agreements included restrictive clauses.
Standard: Office of the Comptroller of the Commonwealth’s “Settlements and Judgments Policy.” ( Office of the Comptroller of the Commonwealth’s “Settlements and Judgments Policy” )
2 recommendations
- CCC should develop, document, and implement a policy related to employee settlement agreements in accordance with CTR’s guidance.agency: agreed
- CCC should refrain from using employee settlement agreements that contain non-disclosure, non-disparagement, or similarly restrictive clauses and should implement a policy regarding the use of employee settlement agreements to promote a transparent and equitable process.agency: partially agreed
Agency response & Auditor reply
Agency: "Despite being an independent agency which is not under the direction of the Governor’s Office, the CCC has adjusted its procedures to no longer include non-disclosure language."
Auditor: "While these are forward-looking steps, we also encourage CCC not to use settlement agreements containing non-disparagement or similarly restrictive clauses."
Why it matters: The breakdown increased legal costs, weakened segregation of duties, created bottlenecks, risked burnout and further turnover, undermined confidence, and increased reliance on informal practices.
Standard: Office of the Comptroller of the Commonwealth’s Internal Control Guide, Chapter 1, Sections 3.01, 3.02, and 3.03. ( CTR’s Internal Control Guide, Chapter 1, Section 3.01; CTR’s Internal Control Guide, Chapter 1, Section 3.02 )
3 recommendations
- CCC should ensure that it has a succession plan to effectively administer general and executive staff member turnover.agency: agreed
- CCC should ensure that there is segregation of duties among all CCC executive staff members.agency: agreed
- CCC should refrain from using external legal counsel to perform core functions.agency: agreed
Agency response & Auditor reply
Agency: "Succession planning efforts, as well as general recruitment and retention efforts, are a focus of the new Executive Director."
Auditor: "We believe that dual role assignments should be avoided, particularly in areas that involve both operational responsibilities and oversight functions."
Why it matters: Weak controls caused inconsistent practices, inadequate documentation, diminished accountability, deficient oversight, and left CCC unprepared to address emerging risks.
Standard: Committee of Sponsoring Organizations of the Treadway Commission Enterprise Risk Management Framework and CTR’s Internal Control Guide. ( CTR’s Internal Control Guide )
2 recommendations
- CCC should ensure that controls around the review processes for both the MRF and HCAs operate effectively.agency: already implemented
- CCC should develop a fully compliant internal control plan and conduct a risk assessment annually.agency: agreed
Agency response & Auditor reply
Agency: "As of [fiscal year] 2025 the Finance Department began receiving automated reports of payments entered into MassCIP and [Medical Use of Marijuana Program Online System]."
Auditor: "While performing our audit work, we determined that, although these reconciliations were occurring, they were not always occurring monthly and reliably."
Why it matters: The control failures risked inaccurate financial reporting, public trust erosion, undetected financial mismanagement, revenue loss, fraud, and delayed reconciliations.
Standard: CTR Revenue Handbook and CTR “Cash Recognition and Reconciliation Policy.” ( CTR Revenue Handbook; CTR “Cash Recognition and Reconciliation Policy” )
4 recommendations
- CCC should implement automated system controls and validation procedures to monitor and prevent duplicate payments.agency: already implemented
- CCC should assign unique revenue codes to different revenue types.agency: already implemented
- CCC should perform regular reconciliations to detect or prevent duplicate transactions.agency: already implemented
- Until CCC implements a reliable system that detects or prevents duplicate transactions, CCC should make licensees aware of potential duplicate fees so that they may safeguard against improper charges by CCC.agency: already implemented
Agency response & Auditor reply
Agency: "The CCC has also added a reconciliation process to catch payments made that are not recorded in the internal licensing software."
Auditor: "We are happy to see that CCC has started reviewing and reconciling payment information after this issue was identified by our audit."
Verified dollar findings
Money paid out that the audit found should not have been - overpayments, unallowable and nonreimbursable charges, improper claims.
Estimated or sample-projected amounts - shown separately because they are not a hard-identified dollar figure.
More audits of this entity
Other Office of the State Auditor reports on Cannabis Control Commission .
- Audit of the Cannabis Control Commission (September 26, 2023)Authority / Commission · September 26, 2023