Chapter 9: Implementation and administration of the medicinal cannabis scheme

The Office of Drug Control in the Health Products Regulation Group of the department has played a central role in implementing and administering the medicinal cannabis scheme since 2016. The ODC is at the front line of the scheme - receiving and making decisions on licence, permit, import and export applications; handling administrative queries and variation requests; providing guidance and advice through the ODC website and in response to individual enquiries; and conducting regulatory monitoring, compliance and enforcement activities.

Not surprisingly, much of the commentary in this Review on the operation of the medicinal cannabis scheme included commentary on the work of the ODC. Many comments did not differentiate between the legislative rules the ODC was administering and how the ODC went about that task. There may, for example, be a dual element in a complaint that an applicant was required to submit more detailed information than seemed warranted, or to re-submit the same information in a fresh application.

The main lines of criticism of the administration of the medicinal cannabis scheme were summarised in Chapter 5 in relation to Key Theme 4.[245] This chapter elaborates on five aspects of the ODC's work:

• its work overall in administering the medicinal cannabis scheme
• its regulatory focus on risk minimisation
• the service provided to existing licence holders
• requests for information and documents under s 14J of the ND Act
• other issues and suggestions for administrative improvement.

A couple of points from the earlier discussion should be restated. The first is that the department received additional funding in 2018 to support the medicinal cannabis scheme. The administrative demands of the scheme were higher than initially anticipated - due principally to the large number of licence applications received. The additional funding will support a marked increase in the number of ODC staff, possibly up to thirty staff.

The funding is also being used for an independent business review of ODC processes, due to be completed in mid-2019. The business review may cover some of the same ground as this Review and may prompt administrative changes that are implemented before this report is published. This chapter is framed on that basis and deals with only a few key issues and makes only three recommendations.

A second point is that recommendations in other chapters of this report would - if implemented - resolve many of the concerns that licence holders and applicants raised with this Review. An example would be the amendment of the ND Regulation to consolidate and reduce the separate number of information and document requirements that a licence applicant is currently required to meet.

The focus of this Review has been the structure and operation of the ND Act. The ODC's regulatory approach is integral to the operation of the Act but has not itself been a free-standing topic of inquiry. The comments that are made about the ODC's work should be approached with that limitation in mind.

There has been general acknowledgement by those participating in this inquiry that the ODC has done well in implementing a complex scheme that has imposed considerably higher administrative and resource demands than was anticipated. Many commentators, in submissions and consultation forums, wished to record their complimentary assessment of the professional way the ODC had implemented the scheme and engaged constructively with applicants over more than two years.

Numerous strengths in the ODC's performance can be noted:

• The medicinal cannabis scheme in the ND Act has been successfully established. The licensing and permit framework is operating in accordance with the ND Act and ND Regulation and 63 licences have been issued and at least twice as many applications are being processed.
• Research into medicinal cannabis is underway at a number of institutions.
• The objective of the Single Convention of ensuring that the community is protected against the diversion of locally cultivated and manufactured cannabis products has been met.
• The ODC has displayed both technical and administrative competence in cannabis regulation.
• The ODC is working well with a diverse range of stakeholders - other government agencies, licence applicants and holders, researchers, exporters and importers, and industry associations.
• Practical guidance and information updates are provided through the ODC website.
• The ODC has been open-minded and responsive to complaints and suggested changes about its administration of the ND Act. Procedural changes have already been implemented and will continue through a business review program that is currently underway.

The first couple of years of the medicinal cannabis scheme have been marked by a strong focus on minimising the risk of criminal incursion in the scheme. Commentators acknowledge why this occurred - to meet the requirements of the Single Convention in establishing a new industry handling a potentially harmful narcotic drug.

However, there is broad acceptance in and outside government that the risk minimisation focus can be reassessed. The risks have been successfully contained to date. Licence applicants and holders have been proactive in demonstrating their preparedness to ensure that criminal risks do not materialise. A closely regulated industry has been established in which the risks may not in practice be as high as once feared.

The rationale for lessening the risk minimisation focus is to reduce the administrative complexity and burden for licence applicants and holders and the ODC. A common theme in many complaints is that there is excessive risk aversion that is displayed in many ways - the extensive range of information required in applications, multiple requests to provide further information, numerous and highly prescriptive conditions imposed on licences and permits, onerous notification and reporting obligations, restrictions on the transfer and use of cannabis products, and time-consuming variation procedures.

The risk minimisation emphasis runs through the ND Act, the ND Regulation and the regulatory method of the ODC. It is not a simple matter of the ODC changing direction and adopting a different risk management strategy. It will necessarily be guided by its responsibility to administer the Act and the Regulation in the form they appear from time to time. Much will therefore depend on whether legislative changes are made along the lines recommended elsewhere in this report.

There is nevertheless scope for the ODC to adjust its work methods, after first articulating its regularity approach and priorities. While the ND Regulation establishes a highly prescriptive framework that the ODC must administer, some of the licensing, permit, monitoring and compliance requirements have a discretionary element. For example, it is open to the ODC to make discretionary decisions on the information that applicants are required to provide, the conditions that will be imposed on licences and permits, the approach to be taken in receiving and approving variation applications, the frequency and scope of inspections and compliance monitoring generally, and the limits set on cannabis product that can be supplied to and held by a testing body.

There is also an overriding strategic regulatory choice - whether to give priority (and dedication of administrative resources) to 'back end' compliance measures such as inspections and monitoring, rather than 'front end' compliance through detailed licence assessment. Adoption of a 'back end' priority may ease the current burden the ODC faces in dealing with a growing backlog of licence applications.

The necessary next step is for the ODC to develop and publish a risk management framework. Two excellent guides for doing so are the Commonwealth Risk Management Policy, published by the Department of Finance in 2014, and the Australian Standard, Risk Management - Guidelines (AS/NZS ISO31000-2018). Although those policies are partly directed to internal risk management and audit in organisations, they are also outward facing.

The goal of the Commonwealth Policy (which draws from the Australian Standard) is stated as follows: 'to embed risk management as part of the culture of Commonwealth entities where the shared understanding of risk leads to well informed decision making'.

The Policy incorporates nine elements that agencies are required to comply with in order to establish an appropriate system of risk oversight and management. The first two elements require agencies to establish a risk management policy and a risk management framework. Following are some excerpts from the Commonwealth Policy to illustrate its relevance to the challenge now facing the ODC of reassessing its risk management focus:

• 'A risk management policy links the entity's risk management framework to its strategic objective(s). Communicating the accountabilities, responsibilities and expectations within an entity's risk management policy is important to ensure a common understanding of risk across the entity. ... An entity must establish and maintain an entity specific risk management policy that: a. defines the entity's approach to the management of risk and how this approach supports its strategic plans and objectives; b. defines the entity's risk appetite and risk tolerance ...' (Element 1)
• 'An entity must establish a risk management framework which includes: ... b. an overview of the entity's approach to managing risk; c. how the entity will report risks to both internal and external stakeholders; ... e. an overview of the entity's approach to embedding risk management into its existing business processes; f. how the entity contributes to managing any shared or cross-jurisdictional risks ...' (Element 2)
• 'A positive risk culture promotes an open and proactive approach to managing risk that considers both threat and opportunity.' (Element 5)
• 'Communicating and consulting about risk underpins the successful management of risk. Effective communication requires consultation with relevant stakeholders and the transparent, complete and timely flow of information between decision makers.' (Element 6)
• 'Accountability and responsibility for the management of shared risks must include any risks that extend across entities and may involve other sectors, community, industry or other jurisdictions.' (Element 7)
• 'The effective management of risk is a process of continuous improvement, requiring regular review and evaluation mechanisms.' (Elements 9)

Recommendation 24

The Office of Drug Control develop a risk management framework dealing with the exercise of its regulatory functions, drawing from the Commonwealth Risk Management Policy and the Australian Standard, Risk Management - Guidelines.

The ODC understandably adopted a 'queuing' system for licence and permit applications. All applications would be queued at the date of receipt and dealt with in that order. This arrangement could be expected to work fairly and efficiently based on the predicted number of licence applications.

Unforeseen developments undermined the sustainability of this arrangement. Up to three times more applications were received than expected. The rate of new applications has not slowed. More time than anticipated has been spent on processing some applications because of inadequate information provided by applicants. Numerous applications have been received to vary the precise details recorded on licences and permits. There have been suggestions too that some new applicants 'game the system' by prematurely lodging inadequate applications either to gain a place in the queue or to obtain ODC advice on necessary steps to improve an application.

The ODC has acknowledged those problems and turned its mind to developing arrangements that are more tailored to client needs and the different categories of ODC work. For example, a guidance statement the ODC issued in October 2018 advised that a new screening assessment process was being introduced to ensure that deficiencies in applications could be addressed shortly after the applications were received.^[246] Another change being introduced on a trial basis with a couple of established licence holders is a fast-track procedure for notifying and accepting licence and permit variations. The business review that is underway is also expected to bring forward proposals for improved case management.

It will be important, going forward, that ODC processes can differentiate the special needs of existing licence holders. They can rightly expect a level of client service that recognises the stage they have reached in preparing an application that has been approved through a demanding and rigorous licencing process. Licence accreditation should be thorough to meet risk objectives, but licence holders have passed that initial threshold. Their commercial investment in applying for a licence and building capacity to undertake cultivation or manufacture has added weight.

Several measures were suggested in submissions for the ODC to provide a better level of service to existing licence holders. These include the appointment of ODC case managers or liaison officers to those licensees; allowing minor licence and permit variations to be approved upon notification; imposing less frequent reporting obligations; granting licences for extended terms; having less prescriptive permit conditions; having a fast-track procedure for manufacture licence applicants who already hold a medicinal cannabis licence; and holding regular industry consultation forums.

Some of those suggestions are picked up in recommendations in this report. Others are likely to be considered in the business review that is underway. With that in mind the following recommendation does not go further than urging the ODC to differentiate the special needs of existing licence holders.

Recommendation 25

The Office of Drug Control review its administrative procedures to identify changes that can be implemented to provide an enhanced level of client service to existing licence holders.

Under s 14J of the ND Act an applicant or licence holder can be required to provide information or documents that are reasonably required for the administration of the Act. As noted in Chapter 7, this and associated regulatory powers enable officers administering the ND Act to be properly informed of all relevant matters.

Several criticisms were made during this Review about s 14J requests, mostly about requests made when licence applications were being assessed:

• Applicants will commonly receive s 14J requests after lodging applications. This raises the question of whether the ODC has provided adequate guidance to prospective applicants as to the information required in applications.
• Section 14J requests may require information that has already been provided in an application or in response to another s 14J request. This suggests that licence applications may not be properly scrutinised or that s. 14J requests work from a standard template or procedure.
• An applicant for multiple licences may receive similar s 14J requests in respect of each application.
• Different applicants will receive similar s 14J requests that do not seem separately tailored to their individual applications.
• The s 14J requests can be extensive and burdensome to comply with. It can be difficult to see why particular information was requested and how it will be relevant to the licensing criteria. This can delay an application being processed.
• Section 14J requests may be poorly framed, which can generate either an inadequate response or a further s 14J request, leading to further delay.
• Section 14J requests that are received separately from the two sections in the ODC (Drug Control Section and Medicinal Cannabis Section) may be duplicative or inconsistent.

It was not practicable in this Review to undertake an authoritative review of s 14J requests. Whether a particular s 14J request was appropriate and well-framed would require referral back to the application to which it related, as well as analysis of how any information provided was subsequently used by the ODC. Some s 14J requests can include more than thirty questions.

However, the review did examine 25 s 14J requests that were a reasonable cross-section of the requests sent to different types of applicants, including some that had made public submissions to this Review. The following general observations can be made:

• Most of the questions raised in s 14J requests appear to have a legitimate purpose - for example, requesting clarification about the design of premises, the fit and proper requirement, business relationships, record keeping arrangements and how security and IT systems will function.
• Some other questions are more open-ended and may be difficult to answer in a reliable manner - for example, who will be responsible for undertaking a future review of a particular document, or how the applicant will respond to natural disasters. It is clear too that some requests would require considerable time and effort to respond to.
• It may be hard to comply with some s 14J questions in advance of a business operation being established - for example, to provide a list of the standard operating procedures that will be in place, or the method of disposal to be used by a third party waste disposal entity.
• A tight timeframe is imposed on some requests that is at odds with the ODC's own processing times - for example, a response within 4-6 weeks 'or the application will be cancelled', when submissions noted that ODC licence processing can take more than a year.

Two things are clear. One is that the ODC makes regular and probing use of the s 14J power. The second is that the ODC's heavy reliance on the power is a source of considerable grievance among many applicants and licence holders. Their complaints echo other themes that have emerged in this Review about the intense risk aversion focus that has been apparent in the first couple years of the medicinal cannabis scheme.

The ODC is currently reviewing its s 14J requests, in conjunction with the business review that is underway. There would be benefit in continuing this review on a periodic and more structured basis. This can be done internally within ODC, with participation of both DCS and MCS staff and independent participation from elsewhere in the department or another agency. What is required, for example, is that the internal audit/review team scrutinise about 5-10 s 14J notices from the previous six months according to the following criteria:

• Were all questions in the s 14J request necessary, properly framed and tied to the licensing criteria in the ND Act and ND Regulation?
• Was the information provided in response to the s 14J requests used in licence processing?
• Were the obligations placed on the applicant or licence holder by the s 14J notice reasonable?
• Was a s 14J request the better option for obtaining the information the ODC required?
• Would better ODC guidance or a better licence or permit application form obviate the need for any of the questions in the s 14J notice?

Recommendation 26

The Office of Drug Control undertake a review, every six months, of a sample of notices issued during the previous six months under section 14J of the Narcotic Drugs Act 1967 requiring the provision of specified information, to evaluate the ODC's reliance on section 14J and the quality of section 14J notices. The review include participation of at least one independent representative from elsewhere in the Australian Government Department of Health or another Commonwealth agency.

This section summarises other comments and suggestions about the ODC's work that were made during this Review in submissions and consultations. The ODC is aware of these points through its own consultations and may consider them as part of the independent business review that is underway.

This Review has not undertaken an independent assessment of these comments and suggested reforms: no endorsement is intended by providing this summary list. The purpose in doing so is to place on the record for present consideration and future reference the thoughtful suggestions that many commentators made.

• Administrative delay in licence and permit applications being finalised was frequently commented upon. It was wryly observed that licences were initially granted for 12 months yet it can take more than 18 months for an application to be approved. The delay can be self-perpetuating, as the licence application may need to be updated and varied during that time. There was support for the introduction of decision making timeframes - either administratively or in the ND Act or ND Regulation. The ODC in fact published its processing timeframes in October 2018:[247] initial receipt and notification (5 working days); screening and requests for further information (10 working days); evaluation and decision (195 working days, plus extra days if the application is varied during evaluation, or while waiting for additional information to be provided.
• A related suggestion was that the dates for payment of application fees and licence charges should be adjusted to better align with the processing timeframes and the commencement of activity under a licence.
• Applicants and licence holders would benefit greatly by the introduction of a web portal or online system for licence administration. This could facilitate lodgement of applications and documents, cross-referral to or attachment of documents already in the system, visibility and tracking of licensing progress, management of variation applications and notifications, information queries being dealt with, and communication generally with the ODC.
• Established licence holders with an unblemished compliance record should be moved to quarterly rather than monthly reporting.
• Coordination and information sharing between the DCS and MCS sections within the ODC could be improved.
• It is not always clear how ODC requests and decisions align with the legislation. Equally, some ODC interpretations of the ND Act and ND Regulation are questionable. These disagreements could more easily be resolved if comprehensive information was published by the ODC, and if that guidance was linked to the relevant legislative provisions. The ODC could also consider, in time, adopting the practice of the Australian Taxation Office of publishing advisory rulings.
• It is important that within the ODC there is appropriate technical and expert knowledge to deal with specialist issues that arise, for example, relating to pharmaceutical, research, manufacturing and industry matters. The ODC should review its staffing profile to ensure that it holds this expertise.
• The criminal history checks that are undertaken during licence assessment should be reviewed to ensure greater efficiency. Checks undertaken through the Australian Federal Police can take longer than those through Crim Trac and should only be used for senior officers in a licensed entity.
• The 200g limit that is placed on the amount of cannabis product that can be held at any time by a testing body is arbitrary and artificial. This limit impedes the small number of testing bodies from receiving batches simultaneously from several licence holders. There is no legal requirement for this limit, and it is odds with long-established practice in other areas where cannabis testing is undertaken (for example, in policing).

• [245] Has the Commonwealth (and in particular the Office of Drug Control) implemented an efficient and effective regulatory scheme for medicinal cannabis? Is an appropriate and proportionate administrative burden imposed on those applying for or holding licences and permits? As to medicinal cannabis licences, is there duplication in the processes and information required in applying for a licence and permit?'
• [246] Office of Drug Control, 'Application processes for licences and permits under the Narcotic Drugs Act 1967' (19 October 2018).
• [247] Office of Drug Control, 'Application processes for licences and permits under the Narcotic Drugs Act 1967' (19 October 2018).