Documentation of the risks involved in performing your business activities. Because any activity can have some risk involved, commercial cannabis businesses create a risk policy as a way of defining those risks. It should set the companies expectations of risks to be managed, who is ultimately responsible for management of the risks, and to what outcome.