Auditor Fitzpatrick finds the state's marijuana program used a license application and evaluation process that lacked consistency and transparency

A new report from State Auditor Scott Fitzpatrick concludes Missouri's multi-billion dollar marijuana industry was launched using a flawed application and evaluation process that ultimately cost the state millions of dollars in litigation expenses. The report, which awards a "fair" rating to the state's Marijuana program, points out how there were significant flaws in the application scoring design that undermined the "blind scoring" goals of the process, and notes how inconsistent scoring and evaluation decisions created significant uncertainty in the licensing results.

"I give credit to the Department of Health and Senior Services for standing up a program of this enormous scope in such a short period of time. It was a monumental task and I know it was not easy but at the same time it's clear there were some significant issues with how license applications were evaluated and scored that cast a shadow over the program and ultimately cost the state millions of dollars," said Auditor Fitzpatrick. "What was meant to be a blind scoring process was able to be circumvented by applicants who provided indications of their identity throughout their applications, and the numbers show applicants who did that won licenses at a greatly increased rate compared to those who followed the rules and remained anonymous. These sorts of issues undermine the confidence applicants and taxpayers have in the legitimacy of the license granting process."

The report documents how the Division of Cannabis Regulation (DCR) allowed applicants to create their own unique identifier to be used on uploaded supporting documents during the scoring process, which allowed applicants to base that identifier on the company's name. A review of 67 facility license applications found that 12 applications (18 percent) included Unique Application Identifier numbers (UAs) that were reasonably indicative of the applicant's business name, such that graders or reviewers familiar with the applicant could potentially deduce the applicant's identity. These applications were not penalized for violating redaction rules. Instead, while only 15 percent of the overall population of applications (348 of 2,257) received licenses, applicants with identifying UAs benefited from the lack of anonymity, with 83 percent (10 of the 12 applications reviewed) being granted licenses.     

The report also found Wise Health Solutions (WHS), which the DCR contracted with to conduct the grading and evaluation of applications, provided guidance to graders to take limited notes to reduce the records available in the event of lawsuits. The WHS training manual provided guidance such as "Say it and forget it, write it and regret it." During a review of 67 license applications, 21 of the 45 scorers (47 percent) made at least 1 scoring assessment contradicting the DCR's own minimum evaluation criteria, and failed to provide any supporting annotations to help explain the discrepancies. This lack of documentation made it impossible to verify whether scoring decisions that were inconsistent with expectations resulted from grading errors, or were due to biases or other factors.

The review of a sample of applications identified significant scoring inconsistencies. A review of the sample of 67 facility applications identified 32 responses from 18 applicants (27 percent of applications reviewed of which 8 were denied and 10 were approved) that contained personal or facility-identifying information, such as names (including only a first name or only a last name), business names, or other prohibited details. A review of the 10 approved applications in the sample with redaction errors determined 6 applications fell below the lowest score that received a license when their scores were adjusted to reflect the redaction rules.

Additionally, WHS graders assigned different scores to identical or nearly identical responses. The audit identified 59 instances involving 14 of the 67 applications reviewed (21 percent) in which two applicants submitted identical, nearly identical, or substantially similar responses, and the grader for the given question assigned different scores. The audit also identified 38 applications (57 percent) in which at least one response that met the minimum criteria of the evaluation question was assigned a score of 0. It also identified 18 instances involving 12 applications (18 percent) for which positive points were assigned to responses that did not meet the minimum criteria. In one instance, a manufacturing facility applicant submitted blank answer sheets for two questions but received a score of 7 for one response and a score of 4 for the other.

The audit describes how perceived and actual deficiencies in the application scoring process were a contributing factor to the state being subject to significant legal challenges and costs. From 2020 through 2023, the DCR incurred over $12.5 million in costs associated with litigation and administrative appeals based on the 2019 licensing process. In total, as a result of appeals, 68 additional licenses were awarded in addition to the 348 original licenses granted via the medical licensing process, representing a 19.5% increase in the total number of license being granted.

The report also takes issue with derogatory and inflammatory language used in the response provided by the Department of Health and Senior Services in an effort to discount the report's findings. The agency indicated in its response that various information in the report is inaccurate, but has not provided appropriate documentation to support its position for these statements. The report notes the response is indicative of the uncooperative conduct the State Auditor's Office encountered from Department of Health and Senior Services personnel throughout the audit.

"I was surprised and disappointed by the adversarial tone the department took with our audit team and the repeated attempts agency officials made to undermine the legitimacy of this report. An audit is meant to be a helpful tool to enhance government efficiency and I am confident our report found several areas where the department can and should improve. I sincerely hope they will change their attitude and view this report as the beneficial roadmap it is meant to be," said Auditor Fitzpatrick.

The audit report also recommends that DCR improve its procedures for oversight and monitoring of licensed marijuana facilities, as well as the overall marijuana market. The report notes the DCR improved its processes throughout the audit period, but many licensees were allowed to operate without ongoing inspections from the DCR, which were required by the department's own rules, and when the DCR did perform inspections, passing grades were sometimes given without the licensee proving compliance. In addition, the DCR performed minimal inventory inspections to ensure cannabis was not being diverted into the black market.

The audit also found dispensaries retain confidential information from customers without obtaining consent from the customer to retain this information. While state regulations require dispensaries to obtain appropriate identification from all users to confirm the customer is old enough to purchase cannabis, regulations do not require data be retained from customers. In addition, state regulations do not address the retention and security of user information for adult-use customers. The report also concludes the statewide track and trace system, Marijuana Enforcement Tracking Reporting & Compliance (Metrc), does not currently have the capability to identify purchases over the legal transaction quantity limits in real time. As a result, marijuana customers are able to purchase more cannabis than what is allowed by the Constitution, and there is an increased risk of diversion and a public safety concern.

Other findings in the report include the DCR failing to process business change requests timely or to adequately track the progress of the requests; significant balances of marijuana taxes and fees existing in both the Veteran Health and Care Fund, and the Veterans, Health, and Community Reinvestment Fund, rather than being distributed as required by the Missouri Constitution; DCR officials approving microbusiness licenses that were not compliant with constitutional requirements and state regulation, and the DCR and the Department of Revenue (DOR) failing to coordinate to allow the DOR to use the DCR's Metrc data to conduct tax audits of marijuana dispensary revenues.

The complete audit can be found here.