Lockton Companies-Header Pic

One of the leading companies in insurance, Lockton Companies, interviewed our CEO, William Cousins about security measures for a cannabis facility. The following is a reproduction of that interview from Lockton’s Cannabis Advisory Newsletter.



With over 35 years of experience in law enforcement and security, Bill Cousins is a subject matter expert in security consulting, risk management and civil litigation suits. His firm, WJ Cousins & Associates LLC, is a trusted advisor for security and risk mitigation matters in the cannabis industry. Visit them at

Q: The security measures for my cannabis facility have been inspected and approved by the Marijuana Regulatory Agency. Is my facility considered safe?

A: The short answer is no. Just because you meet the minimum physical security requirements with video surveillance, alarms and access control doesn’t mean your facility safe. You need to have a crisis management plan which includes standard operating procedures for security-related incidents. For example, it should contain step-by-step instructions for adverse events such as armed robbery, workplace violence incidents, and sexual harassment, just to name a few. Your employees need to receive training, so they know how to react and handle such incidents. Failure to have these plans and training not only place your employees and customers at risk, but it also places your entire business enterprise at risk.

Q: I keep hearing about “risk.” How do I mitigate my overall business risk?

A: In order to take your enterprise to the next level, you need to appoint a qualified employee to act as your Risk/ Compliance Officer. Then that officer needs to develop
an overall cannabis risk management framework. This framework is used as a formal plan to identify, analyze and influence potential risk opportunities. It should contain the following six components:

• Internal control environment
• Risk assessment
• Control activities
• Information and communication
• Training
• Assurance

[ Click here to download the original PDF for the interview. For more information about Lockton Companies, click here. ].


WJ Cousins and Associates founder, William Cousins, has over 35 years in the security industry—22 years of that spent as a US Secret Service agent. He and WJCA can be of service in these kinds of situations. For more information about WJ Cousins and Associates or our services—security policies, procedures, and crisis management plans—contact them or call them at 248.783.7190 to discuss your security needs.

Teamployer Logo

WJ Cousins and Associates are focused on helping our clients minimize the risks they face every day. One common concern or complaint our clients can relate to is personnel or problems with employees which deal with human resource matters. These problems can be anything from payroll issues to internal diversion issues, to sexual harassment or workplace violence complaints. Since your team members are your “ambassadors” to the customers, these issues need to be addressed in a fair and swift manner, which keeps you compliant with the current labor laws and administrative rulings.

In an effort to provide a solution for our clients, WJ Cousins and Associates has entered into a strategic partnership with Teamployer. They are a full-service company that specializes in providing Human Resources and payroll services to cannabis businesses. Their menu of services cover:

  • HR Administration
  • HR Software
  • Talent Management
  • Time and Attendance
  • Payroll
  • Tax Administration
  • Workers Compensation
  • Employee Benefits

We believe Teamployer is the best company available to ease the everyday administrative burdens and keep you legally compliant and out of the courtroom.


Should you have any questions, please feel free to contact us or e-mail our Teamployer representative, Frank Benages, or call him at 734.536.5646.


For more information about WJ Cousins and Associates or our services—security policies, procedures, and crisis management plans—e-mail us or call us at 248.783.7190.

Weighing Cannabis-Looping For Diversion

We recently joined the Association of Certified Commercial Cannabis Experts (ACCCE). The association brings together like-minded risk and compliance professionals who collaborate to identify and provide solutions to risks affecting the cannabis industry. As we reviewed some of their resource material, we found an article about “Looping,” which is a tactic used by individuals to purchase cannabis products in excess of the legal limit. The article was written by Brion Nazzaro, President of ACCCE. We found it to be informative and definitely worthwhile for anyone who is associated with the cannabis industry.

By instilling a risk culture starting with tone at top, the company can significantly reduce the potential risks of looping by utilizing the ACCCE Cannabis Risk Management Framework and implementing a risk-based approach. As with many other industries, commercial cannabis has its offenders that, undeterred, could cause significant loss of reputation to the commercial cannabis industry and brands through their actions.

Cannabis products continue to have a large demand on the illicit market, and it is the risk professional’s responsibility to guard against diversion. To prevent diversion, jurisdictions commonly have limits on the amount of cannabis a consumer is able to purchase in a single transaction. To get around the limit, a criminal or group of criminals may practice looping.

The Looping Example
Looping is the practice of evading the legal cannabis purchase limits by buying cannabis products at or below the legal limit repeatedly during a limited time period to obtain an illegal amount of cannabis product. The name comes quite literally from people going into the dispensary to purchase the maximum amount of cannabis, taking it to their car, and looping back around to the dispensary to repeat the process multiple times within the same day or even the same hour.

The looping case against a large Colorado commercial cannabis business was the first of its kind and included budtenders, managers, and owners who received hefty fines or jail sentences. The Denver Police Department was initially tipped off after a citizen noticed seeing several people making multiple trips each day to and from their parked vehicles to the store, continuing these loops for several hours at a time.

It is not always this straightforward to catch looping. Looping can involve a single consumer, multiple consumers working together, inside collusion, and multiple stores. To manage the risk of looping, risk officers need to implement risk-based controls to keep their consumer sales locations safe from looping schemes and tactics.

“It is not always this straightforward to catch looping. Looping can involve a single consumer, multiple consumers working together, inside collusion, and multiple stores. In order to manage the risk of looping, risk officers need to implement risk-based controls to keep their consumer sales locations safe from looping schemes and tactics.”

How to Reduce Looping Risk
The risk officer should help the commercial cannabis business owners or executives craft a policy to prevent diversion. It is important for the owners or executives to set the tone and establish the company’s intent to control diversion to enable the risk officer to effectively mitigate looping risks. The intention of the policy is to demonstrate to employees and vendors the commercial cannabis business’s reasonable efforts to control their points of diversion.

The risk officer should conduct a risk assessment that indicates the likely looping schemes to which the commercial cannabis business is exposed, or may be exposed. For example, a customer base that routinely buys near the legal limit may increase the chance that loopers are hiding in legitimate transactions. Similarly, in judging your geographic risk, being near a jurisdictional border may increase the likelihood that out-of-state loopers have access to a commercial cannabis business location. The risk assessment allows the risk officer to focus efforts on the most likely looping scenarios first and has the most effect on reducing overall looping risk.

Having identified the highest looping risks, the risk officer will then need to engage all staff to determine the control activities that will mitigate the inherent risks of looping identified in the risk assessment. Each commercial cannabis business will have a different looping risk profile, but there are standard controls across consumer sales that create a strong foundation. Creating a process for employees to raise looping concerns directly with the risk officer allows the commercial cannabis business to react quickly to poor controls or changes in their risk profile. Monitoring cannabis product transactions that are close to, or at the maximum purchase limit, throughout all locations is an effective means of identifying potential looping schemes.

To effectively manage looping risk, the risk officer should create reports that help management and the owners understand the effect of their work and present the results periodically. Standard reports should be created to assist management in understanding the scale and scope of looping risk. This should allow management to make appropriate risk-based decisions that consider this risk. For example, the level of looping risk at a commercial cannabis business may inform the extent of dual control expected at a store location.

A comprehensive risk program also includes risk-based training. Depending on the risk level of looping, the frequency of training may be more or less; however, it is common practice to have all consumer-facing employees trained to spot consumers exhibiting suspicious behaviors. Risk-based training should include how to spot red flags of looping with a focus on the looping schemes that were identified as highest risk in the risk assessment. Training should also include how to report suspicious activity to the risk officer.

Looping will always be a risk for commercial cannabis businesses. To make sure anti-looping mitigation remains effective and efficient over time, the risk officer should consider periodic assurance activities. Some common assurance activities include hiring a secret shopper to visit storefronts to test controls, monitoring the number of suspected or confirmed looping attempts over time for increases, or conducting periodic audit of controls. These activities will assist the risk officer in balancing the cost of mitigation with the risk the business faces.

An effective risk-based approach to control looping will reduce the chances that a commercial cannabis business will be targeted by organized criminals attempting to divert product to the illicit market. A legal commercial cannabis business found complicit in looping could cause a loss of reputation or even loss of the commercial cannabis license. Not every looper can be stopped, but implementing an effective cannabis risk management framework can reduce the likelihood that a commercial cannabis business is found complicit in looping activity.


This article highlights a significant vulnerability, faced by cannabis businesses every day. It brings attention to the threat not only being from external sources, but also from complicit or untrained employees, too.

So, can the “looping” tactic be totally stopped? Well, the answer is “No,” but by implementing simple measures and documented protocols into your Risk Management Framework (RMF), you can minimize your exposure.


Now then, what are the steps the cannabis business should take? Well, WJ Cousins and Associates recommends that a business first have a risk assessment conducted to identify any weaknesses in your current protocols and record keeping. Once any weaknesses have been identified, employees should be trained, and new protocols should be documented.


For assistance in this and many other concerns regarding a cannabis business, do not hesitate to contact us. We are here to assist you in protecting your business.


[ Article Credit: Brion Nazzaro, November 2, 2020 | Category: “Cannabis Risk Management Framework, Organized Crime.” The Association of Certified Commercial Cannabis Experts (ACCCE) is dedicated to advancing the professional knowledge and skills of those committed to commercial cannabis risk management. (Link to original article) ]

Duty Of Care (Photo Credit - Nick_Youngson)

“Duty of Care” is an Essential Concept for Any Cannabis Business

As a new cannabis license holder, you have many items on your to-do list when it comes to setting up and launching your business. And while it is easy to be consumed by getting your enterprise up and running, there is one thing you want to be sure you HAVE NOT missed: securing your business against an adverse incident when it comes to security and safety. Just one such incident could put your business in jeopardy. This is what we would refer to as The Next Chapter of your business, or, now that you have it, to keep it!

It all goes to one legal concept: “Duty of Care.” According to the legal dictionary, “A duty of care is the legal responsibility of a person or organization to avoid any behaviors or omissions that could reasonably be foreseen to cause harm to others.” In other words, if you are not proactive with obtaining the proper documentation, it increases the chances that you are more likely to be a defendant in a civil suit.

Obviously, no business owner can foresee all possibilities, but you should exercise a reasonable effort to try and mitigate any potential problems. That is why WJ Cousins and Associates recommend having a well-documented set of security policies and procedures, training for your employees, and a Crisis Management Plan. Having these will certainly help with your “Duty of Care” responsibilities. These policies and procedures should address two areas.


First, are the daily operational procedures. Having this reference and requiring your employees to read and acknowledge understanding will pay dividends for business operations as well as help in the event of a discipline or human resource issue.

Second, all cannabis businesses should have a Crisis Management Plan, which will provide specific guidance to leadership and employees for such events as an armed robbery or medical emergency.


Another threat to your business can be failures to be compliant with regulatory requirements. Recently, the Marihuana Regulatory Agency conducted investigations (or inspections) into several facilities which resulted in significant fines to the business owners. These issues could have been avoided by having documented procedures that would have ensured all security technology and procedures are functioning as required by regulations.


Having an experienced security partner at your side who has a specialization in the cannabis industry can help you make your new business venture a success and avoid the security pitfalls that can jeopardize your investment.

For more information about security policies, procedures, and crisis management plans, e-mail us or just call us at 248-783-7190.

Remember, you need to protect your investment!

[ Photo credit: Nick Youngson ]

Portfolio Items