Job Profile: Staff Auditor

Job Overview

The Staff Auditor serves as a critical guardian of financial and operational integrity within the cannabis enterprise. This role operates in a business environment defined by unique financial complexities, including the challenges of Internal Revenue Code 280E, extensive cash handling, and a patchwork of state-specific regulations that govern every transaction from seed to sale. The Staff Auditor executes detailed audit programs to evaluate the effectiveness of internal controls, assess and mitigate risks, and ensure compliance with both company policies and external regulations. This position is foundational to building investor confidence, maintaining hard-won operating licenses, and creating a scalable governance framework that can support rapid growth. The auditor’s work directly impacts the organization's ability to operate with financial discipline and prepare for future liquidity events such as mergers, acquisitions, or public offerings.

A Day in the Life

The day's activities begin with an operational audit at a cultivation facility. The Staff Auditor observes the morning inventory cycle count, a critical internal control. This involves selecting a sample of plant batches in the flowering stage and physically verifying the count against the data logged in the state-mandated seed-to-sale tracking system, such as METRC. The auditor examines the RFID tags on the plants, confirms their status in the system, and reviews the documentation for any recent plant movements or destructions. This process provides direct evidence that the company's most valuable biological assets are accurately tracked and safeguarded against diversion.

The focus then shifts to the financial control environment. The Staff Auditor reviews the daily cash reconciliations from three high-volume retail dispensaries. This task involves a detailed examination of end-of-day reports from the Point-of-Sale (POS) system, vault logs, and armored transport manifests. A sample of high-value cash transactions is selected for walkthrough testing. The auditor traces the cash from the initial sale recorded in the POS, through the cash drawer closeout, to its inclusion in the master deposit slip, and finally confirms its receipt on the corresponding bank statement. This meticulous testing validates the control effectiveness over the company's largest and most high-risk asset: physical cash.

Midday is dedicated to evaluating IT controls. The auditor meets with the IT infrastructure team to review the user access control list for the company’s Enterprise Resource Planning (ERP) system. The objective is to identify potential segregation of duties conflicts. For example, the auditor verifies that an employee responsible for entering new vendors into the system does not also have the permissions to approve payments. The auditor requests and reviews system-generated logs that show all changes made to critical financial master data, ensuring that each change was properly authorized and documented.

The afternoon involves leveraging technology to perform data analytics. Using a tool like ACL (Audit Command Language), the Staff Auditor executes a pre-written script to analyze the entire procure-to-pay transaction file for the previous quarter. The script is designed to identify high-risk anomalies, such as duplicate vendor payments, payments made on weekends, or invoices that fall just below the senior management approval threshold. The results of this analysis are then compiled into a clear summary. The day concludes with the auditor drafting a preliminary findings report for the Senior Auditor, outlining a newly identified control weakness in the accounts payable process and proposing a practical risk mitigation strategy. This report will form the basis for a future presentation to department management.

Core Responsibilities & Operational Impact

The Staff Auditor is responsible for executing across three primary domains of influence:

1. Financial & Operational Control Assessment

• Internal Controls Testing: Systematically executing audit test plans for key business cycles. This includes verifying the accuracy of inventory costing under IRC 280E, confirming the reconciliation of physical assets to financial records, and testing revenue recognition from dispensary sales.
• Risk Assessment: Participating in risk assessment workshops to identify and evaluate financial, operational, and compliance risks across the organization. This involves analyzing processes like new product launches or entry into new state markets to pinpoint potential control gaps before they materialize.
• Control Effectiveness Evaluation: Analyzing audit evidence to determine not just if a control exists, but if it is operating effectively and consistently. This includes making recommendations to strengthen controls that are poorly designed or inconsistently applied.

2. IT Systems & Data Integrity Audits

• ERP Systems Integrity: Auditing the configuration, security, and change management processes within core ERP systems like NetSuite or SAP. The objective is to ensure that financial data is complete, accurate, and secure from unauthorized access or alteration.
• IT Controls Review: Testing IT general controls (ITGCs), such as logical access protocols, data backup and recovery procedures, and system development lifecycles. This work confirms the reliability of the underlying technology infrastructure that supports all business operations.
• Data Analytics Execution: Utilizing tools like ACL or IDEA to perform full-population testing of large datasets. This includes analyzing sales data for compliance with daily purchase limits or examining payroll data for ghost employees.

3. Stakeholder Engagement & Reporting

• Presentation Support: Assisting in the development of clear and concise audit reports and presentations for management. This involves summarizing complex findings, quantifying risks, and providing well-reasoned recommendations for improvement.
• Risk Mitigation Collaboration: Engaging directly with process owners in finance, retail, and cultivation departments to discuss audit findings and collaborate on developing effective and practical remediation plans.
• Documentation & Workpaper Management: Maintaining high-quality audit workpapers that clearly document the test procedures performed, evidence obtained, and conclusions reached, ensuring a clear audit trail for management and external auditor review.

Strategic Impact Analysis

The Staff Auditor's work creates tangible value and mitigates risk across the enterprise's key performance indicators:

Chain of Command & Key Stakeholders

Reports To: This position typically reports to a Senior Auditor, Internal Audit Manager, or Director of Internal Audit. In smaller organizations, the role may report directly to the Controller or Chief Financial Officer.

Similar Roles: This role shares skill sets with positions like Financial Analyst, Compliance Analyst, and IT Auditor. A Financial Analyst focuses on analyzing business performance, while the Staff Auditor focuses on the integrity of the controls that produce the performance data. A Compliance Analyst focuses broadly on regulatory adherence, while the Staff Auditor specifically tests the financial and IT controls that support that adherence. An IT Auditor has a specialized focus on technology risk, which is one component of the Staff Auditor's broader responsibilities.

Works Closely With: The Staff Auditor must build strong working relationships with the Accounting Team to understand financial processes, the Head of Retail Operations to evaluate cash handling and inventory controls, and the Director of Cultivation to audit plant tracking and asset management.

Technology, Tools & Systems

Proficiency with a specific set of technologies is essential for high performance in this role:

• ERP Systems: Deep familiarity with navigating and extracting data from enterprise systems such as SAP, Oracle NetSuite, or Microsoft Dynamics, as well as cannabis-specific platforms like Flourish or Canix.
• Data Analytics Software: Hands-on experience using tools like ACL or IDEA to analyze large datasets, identify patterns and exceptions, and perform automated testing of entire populations of transactions.
• Seed-to-Sale Tracking Systems: Understanding of the functionality and data structure of state-mandated compliance systems, primarily METRC, but also BioTrackTHC and Leaf Data Systems, as these are primary sources of audit evidence.
• Audit Management Platforms: Experience with Governance, Risk, and Compliance (GRC) software such as Workiva, AuditBoard, or HighBond for managing audit projects, documenting workpapers, and tracking the remediation of findings.

The Ideal Candidate Profile

Transferable Skills

Top candidates for this role often come from other highly regulated and process-driven industries:

• Public Accounting: Experience from a Big 4 or national accounting firm, particularly in financial audit or risk advisory, provides a strong foundation in audit methodology, risk assessment, and SOX compliance.
• Manufacturing or Consumer Packaged Goods (CPG): A background in these sectors provides critical expertise in inventory control, cost accounting, and supply chain management, which are directly applicable to vertically integrated cannabis operations.
• Banking & Financial Services: Professionals from this industry bring valuable skills in auditing cash management processes, anti-money laundering (AML) controls, and regulatory compliance frameworks.
• Internal Audit in any Public Company: Experience in an established internal audit department provides direct knowledge of the COSO framework, risk-based auditing, and stakeholder engagement.

Critical Competencies

The role demands a specific set of professional attributes for success:

• Professional Skepticism: A mindset that encourages questioning assumptions and critically evaluating audit evidence. In a young industry with rapidly evolving processes, the ability to look beyond the surface is essential.
• Process-Oriented Thinking: The capacity to deconstruct complex business operations, identify key control points, and assess how information and assets flow through the system.
• Data Acumen: The ability to work with large, complex datasets from multiple sources, using technical tools to derive meaningful insights and identify anomalies that require further investigation.

Top 3 Influential Entities for the Role

The standards and guidance from these organizations shape the professional practice of a Staff Auditor:

• The Institute of Internal Auditors (IIA): The primary global professional body for internal auditors. The IIA's International Professional Practices Framework (IPPF) provides the mandatory standards for performing audit work, and its Certified Internal Auditor (CIA) designation is the premier credential in the field.
• COSO (Committee of Sponsoring Organizations of the Treadway Commission): COSO provides the leading framework for designing, implementing, and evaluating internal controls. An auditor’s entire approach to assessing control effectiveness is grounded in the principles of the COSO framework.
• Public Company Accounting Oversight Board (PCAOB): For any cannabis company that is publicly traded or aspiring to be, PCAOB auditing standards set the benchmark for rigor. Internal auditors align their work with PCAOB expectations to ensure a smooth and efficient external audit process.

Acronyms & Terminology