The Oregon Secretary of State, in an audit of the state recreational marijuana program, raised questions about the reliability and security of the Cannabis Tracking System, the seed-to-sale system used to keep legally grown marijuana off the black market.

The 41-page report, released Wednesday, found “data reliability issues” with the software platform provided by a contractor, Metrc, to track each marijuana plant grown by licensees from seed to sale. The audit also found “an insufficient number” of compliance inspectors is hindering the Oregon Liquor Control Commission’s ability to monitor the recreational marijuana program.

The OLCC responded with a 15-page response of its own. The agency is hampered by lack of equipment and a need for qualified personnel with technical expertise, according to the response dated Jan. 26. Regulating legal cannabis is “essentially a new business startup,” and the commission is faced with dealing with multiple issues on deadline, it states.

“We didn’t really take issue with anything,” said Mark Pettinger, OLCC recreational marijuana program spokesman, referring to the audit findings. The audit acknowledged hurdles facing the OLCC in creating a set of rules and a framework to enforce them on short notice.

For example, Pettinger said, the IT director hired for the OLCC, Tom Atwood, started work Feb. 1 and resigned Monday after accepting another job in the private sector.

“Recruiting is a challenge,” Pettinger said. And, “we have a lot of antiquated equipment and an aging IT system.”

The Secretary of State audit makes a case for the OLCC for further funding from the Oregon Legislature for more personnel, equipment and training, he said. The tracking system is one of three enforcement prongs, the others being on-site visits and background checks and security measures such as video surveillance systems.

The audit report was released days after a summit convened Friday in Portland by U.S. Attorney Billy Williams — attended by state and federal law enforcement officials, Gov. Kate Brown, cannabis industry representatives and grassroots groups opposed to marijuana production — to address enforcement of federal law on marijuana. Oregon is the recognized source of an oversupply of marijuana finding its way illegally to states where cannabis is not legal.

The audit calls on the OLCC to improve the security and reliability of information in the seed-to-sale tracking and marijuana-licensing systems. It found the OLCC “has not implemented an effective IT security management program for the agency as a whole.”

Neither has it developed a plan to restore computerized data and applications in the event of a disaster. The audit identified eight IT security issues “that significantly increase the risk that OLCC’s computer systems could be compromised, resulting in a disruption of OLCC business procedures.”

The audit depicts an agency swamped by the magnitude of the task imposed upon it. The number of applicants for state-issued licenses to grow, sell, process or test cannabis, in 2015 was estimated to number initially between 800 and 1,300. By December 2017, the number of applicants had risen to 3,100, with 1,600 approved, according to the audit.

“OLCC had little time to develop processes and procedures, and implement new information systems to support and regulate this industry in time for the mandated January 2016 launch date,” the audit report reads.

The audit found data from the online seed-to-sale tracking system did not always match sales with inventory, or with market pricing.

Pettinger said the seed-to-sale system isn’t foolproof, but it’s the industry standard employed by other states, including Colorado and Nevada. It provides enough information that discrepancies may be flagged. Many other regulatory systems are based on self-reporting, tax payments, for instance, he said.

“There are explicit penalties for manipulating data,” Pettinger said. “It’s difficult to prevent cheating but not to detect it.”

— Reporter: 541-617-7815, jditzler@bendbulletin.com