02/18/2026 - JEFFERSON CITY, Mo.
A new report from State Auditor Scott Fitzpatrick concludes
Missouri's multi-billion dollar marijuana industry was launched using a flawed
application and evaluation process that ultimately cost the state millions of
dollars in litigation expenses. The report, which awards a "fair"
rating to the state's Marijuana program, points out how there were significant flaws in the
application scoring design that undermined the "blind scoring" goals
of the process, and notes how inconsistent scoring and evaluation decisions
created significant uncertainty in the licensing results.
"I give credit to the Department of Health and
Senior Services for standing up a program of this enormous scope in such a
short period of time. It was a monumental task and I know it was not easy but
at the same time it's clear there were some significant issues with how license
applications were evaluated and scored that cast a shadow over the program and
ultimately cost the state millions of dollars," said Auditor Fitzpatrick.
"What was meant to be a blind scoring process was able to be circumvented
by applicants who provided indications of their identity throughout their
applications, and the numbers show applicants who did that won licenses at a greatly
increased rate compared to those who followed the rules and remained anonymous.
These sorts of issues undermine the confidence applicants and taxpayers have in
the legitimacy of the license granting process."
The report
documents how the Division of Cannabis Regulation (DCR) allowed applicants
to create their own unique identifier to be used on uploaded supporting
documents during the scoring process, which allowed applicants to base that
identifier on the company's name. A review of 67 facility license applications
found that 12 applications (18 percent) included Unique Application Identifier
numbers (UAs) that were reasonably indicative of the applicant's business name,
such that graders or reviewers familiar with the applicant could potentially
deduce the applicant's identity. These
applications were not penalized for violating redaction rules. Instead, while
only 15 percent of the overall population of applications (348 of 2,257)
received licenses, applicants with identifying UAs benefited from the lack of
anonymity, with 83 percent (10 of the 12 applications reviewed) being granted
licenses.
The report also
found Wise Health Solutions (WHS), which the DCR contracted with to conduct the
grading and evaluation of applications, provided guidance to graders to take limited notes to reduce the records
available in the event of lawsuits. The WHS training manual provided guidance
such as "Say it and forget it, write it and regret it." During a
review of 67 license applications, 21 of the 45 scorers (47 percent) made at
least 1 scoring assessment contradicting the DCR's own minimum evaluation
criteria, and failed to provide any supporting annotations to help explain the
discrepancies. This lack of documentation made it impossible to verify whether
scoring decisions that were inconsistent with expectations resulted from
grading errors, or were due to biases or other factors.
The review of a sample of applications identified significant
scoring inconsistencies. A review of the
sample of 67 facility applications identified 32 responses from 18 applicants
(27 percent of applications reviewed of which 8 were denied and 10 were
approved) that contained personal or facility-identifying information, such as
names (including only a first name or only a last name), business names, or
other prohibited details. A review of the 10 approved applications in the
sample with redaction errors determined 6 applications fell below the lowest
score that received a license when their scores were adjusted to reflect the
redaction rules.
Additionally, WHS graders assigned different scores to identical
or nearly identical responses. The audit identified
59 instances involving 14 of the 67 applications reviewed (21 percent) in which
two applicants submitted identical, nearly identical, or substantially similar
responses, and the grader for the given question assigned different scores. The
audit also identified 38 applications (57 percent) in which at least one
response that met the minimum criteria of the evaluation question was assigned
a score of 0. It also identified 18
instances involving 12 applications (18 percent) for which positive points were
assigned to responses that did not meet the minimum criteria. In one instance,
a manufacturing facility applicant submitted blank answer sheets for two
questions but received a score of 7 for one response and a score of 4 for the
other.
The audit
describes how perceived and actual deficiencies in the application scoring
process were a contributing factor to the state being subject to significant
legal challenges and costs. From 2020
through 2023, the DCR incurred over $12.5 million in costs associated with
litigation and administrative appeals based on the 2019 licensing process. In
total, as a result of appeals, 68 additional licenses were awarded in addition
to the 348 original licenses granted via the medical licensing process,
representing a 19.5% increase in the total number of license being granted.
The report also takes issue with derogatory and inflammatory
language used in the response provided by the Department of Health and Senior
Services in an effort to discount the report's findings. The agency indicated
in its response that various information in the report is inaccurate, but has
not provided appropriate documentation to support its position for these
statements. The report notes the response is indicative of the uncooperative
conduct the State Auditor's Office encountered from Department of Health and
Senior Services personnel throughout the audit.
"I was surprised and disappointed by the adversarial tone the
department took with our audit team and the repeated attempts agency officials
made to undermine the legitimacy of this report. An audit is meant to be a
helpful tool to enhance government efficiency and I am confident our report
found several areas where the department can and should improve. I sincerely
hope they will change their attitude and view this report as the beneficial
roadmap it is meant to be," said Auditor Fitzpatrick.
The audit report also recommends that DCR improve its procedures for oversight and
monitoring of licensed marijuana facilities, as well as the overall marijuana
market. The report notes the DCR improved its processes throughout the audit
period, but many licensees were allowed to operate without ongoing inspections
from the DCR, which were required by the department's own rules, and when the
DCR did perform inspections, passing grades were sometimes given without the
licensee proving compliance. In addition, the DCR performed minimal inventory
inspections to ensure cannabis was not being diverted into the black market.
The
audit also found dispensaries retain confidential information from customers
without obtaining consent from the customer to retain this information. While state regulations require dispensaries
to obtain appropriate identification from all users to confirm the customer is
old enough to purchase cannabis, regulations do not require data be retained
from customers. In addition, state regulations do not address the retention and
security of user information for adult-use customers. The report also concludes
the statewide
track and trace system, Marijuana Enforcement Tracking Reporting &
Compliance (Metrc), does not
currently have the capability to identify purchases over the legal transaction
quantity limits in real time. As a result, marijuana customers are able to
purchase more cannabis than what is allowed by the Constitution, and there is
an increased risk of diversion and a public safety concern.
Other findings in the report include the DCR failing to process
business change requests timely or to adequately track the progress of the
requests; significant balances
of marijuana taxes and fees existing in both the Veteran Health and Care Fund,
and the Veterans, Health, and Community Reinvestment Fund, rather than being
distributed as required by the Missouri Constitution; DCR officials approving microbusiness licenses that
were not compliant with constitutional requirements and state regulation, and the
DCR and the Department of Revenue (DOR) failing to coordinate to allow the DOR
to use the DCR's Metrc data to conduct tax audits of marijuana dispensary
revenues.
The complete audit can be found here.
