Tony Gallo, Managing Partner of Sapphire Risk Advisory Group – Interview Series

Despite heavy regulations—particularly around store and facility security—loss prevention remains a widespread issue across state cannabis markets. Vulnerabilities can take many forms: overly relaxed access control and badge-scanning policies, internal theft, or simply leaving exterior doors open to pests and pathogens. Without a dedicated security system and qualified professionals in place, loss prevention risks can emerge from almost anywhere and compound faster than industrial hemp.

For a deeper look into time-tested loss prevention strategies—and how security regulations might shift if a facility becomes Schedule III-registered—mycannabis.com spoke with Tony Gallo, Managing Partner at Sapphire Risk Advisory Group.

While obtaining your Bachelor’s in Criminal Justice from Kean University, how do you remember cannabis use and cannabis consumers themselves being portrayed through the coursework? How were previous cannabis laws and policies discussed?

I graduated from college in 1983, so I would separate the criminal justice perspective of that era from what we understand about cannabis today. Back then, the prevailing conversation centered on illegality, enforcement, and the consequences of possession or distribution. That conversation left much less room for the distinctions we now make among medical patients, adult consumers, and licensed business owners.

I wouldn’t want to attribute a particular position to a professor or textbook without reviewing it. But the bigger change in my career has been moving from viewing cannabis primarily through an enforcement framework to helping legitimate businesses protect their employees, customers, and products. Cannabis consumers come from every background, and effective security starts with treating people professionally and respectfully.

How did you first enter the field of loss prevention? How did you utilize your Criminal Justice degree during those roles?

I started as a retail store detective in a shopping mall. It was the best job I have ever had…being in my early 20s, surrounded by hundreds of women, and getting paid to play mall cop. That job did give me a ground-level understanding of theft, investigations, employee behavior, and the daily realities of running a store.

My Criminal Justice education provided a foundation for observing behavior, evaluating evidence, documenting incidents, and understanding the importance of consistent procedures. Just as important was knowing that suspicion and a fact are two different things.

As my responsibilities grew, my focus expanded beyond catching someone stealing. It became about understanding why a loss occurred and what the business could change to prevent it. That is still how I approach loss prevention/security today.

Throughout your early roles and into your long role with EZCorp, how did using security technology and database systems become an increasing part of your role and duties? How did those systems help minimize the loss prevention issues of the company you were working for?

Over the course of my career, loss prevention became increasingly driven by information. Cameras, alarms, access controls, transaction records, and reporting systems gave us a broader view of what was happening across a business.

In a company with multiple locations, you cannot personally watch every transaction or review every minute of video. You need systems that help identify exceptions: unusual refunds, inventory discrepancies, cash shortages, or patterns that deserve a closer look.

The real value comes from connecting the information. A transaction report may identify something unusual, video may provide context, and an investigation may reveal whether the cause was theft, a training problem, or a weak procedure.

Technology helps direct your attention. Experienced people still have to interpret what it means and take action. A good theft interviewer was still the most important tool to have in your department.

After being with EZCorp for nearly two decades and other well-known companies before that, what caught your attention about applying your expertise in loss prevention to cannabis businesses? Was it simply just the states starting to legalize cannabis recreationally, or were there other factors at play as well?

I entered the cannabis industry in 2013 after getting a call to speak at a new startup event called MJBiz. Having focused on high-risk retail security for most of my career, the cannabis industry was a natural course. 

The cannabis industry faces challenges familiar from retail, pawn, jewelry, and other high-risk environments: valuable inventory, cash exposure, employee safety, internal theft, and the need for reliable operating procedures. They also had an additional challenge: building those protections around a developing regulatory system.

My background gave me a practical way to contribute. These businesses needed security that could satisfy regulators while supporting their everyday operations.

For over 13 years, Sapphire Risk Advisory Group has helped more than 800 cannabis clients in 38 states. The goal has always been to help them build businesses that are safe, compliant, and able to succeed.

Given that you’ve previously held loss prevention roles for major retailers such as Sears, what are the biggest differences between LP roles and duties within traditional retail and LP roles within cannabis businesses?

The fundamentals are very similar. You need to protect people, control inventory, account for money, and investigate discrepancies.

The biggest difference is what a failure can put at risk. In traditional retail, an inventory shortage is generally a financial and operational problem. For example, the loss of a watch or clothing. In cannabis, that same shortage can result in exposure of the community to a drug, much like a loss at a pharmacy can be socially exposed, or liquor at a liquor store

Cannabis also requires attention to activities that a conventional retailer may never encounter: cultivation, harvesting, processing, waste destruction, and transfers between licensed facilities.

Another difference is how early security needs to enter the conversation. Consider the floor plan, receiving area, product movement, employee access, and secure storage before construction. That is why I tell people, “Design first. Install second.”

From your experience, how effective are most state cannabis regulations for security and loss prevention? Do some state markets have more relaxed security standards than others?

My view is that regulations establish an important foundation, but passing an inspection does not prove that a business has an effective loss prevention program.

Requirements vary by jurisdiction and license type. Some rules prescribe equipment and procedures in detail; others allow more discretion. Local requirements can add another layer. I would be cautious about calling an entire state “relaxed” without specifying which requirement and which type of operation we are discussing.

The larger issue is that equipment requirements alone cannot create accountability. A business can have cameras and still fail to review incidents. It can have access control and still allow employees to share credentials.

Regulations establish obligations. Management has to turn those obligations into daily practices.

From the cannabis clients you’ve worked with through Sapphire Risk Advisory Group, what are the most common security and loss-prevention issues they face? Where do those issues usually begin, and how fast can those issues quickly compound in an industry as highly regulated as cannabis?

The issues I focus on most are inventory discrepancies, weak cash controls, excessive employee access, inconsistent procedures, and security systems that are installed but poorly managed.

Those problems often begin with a small operational shortcut. Someone shares a login. A receiving discrepancy gets accepted without investigation. Someone makes an inventory adjustment without supporting documentation. A terminated employee’s access remains active.

When those shortcuts become normal, the business loses the ability to explain what happened, who was involved, and where the product or money went.

In cannabis, that can compound quickly. An unexplained shortage can become a tracking discrepancy, an investigation, and potentially a compliance issue. Addressing the first warning sign is usually much easier than reconstructing weeks of activity afterward.

Beyond regulatory requirements, what are some universally effective strategies cannabis businesses of all types can use to minimize loss-prevention issues?

Start with clear accountability. Every employee should understand what they are responsible for, what they are authorized to access, and when they must report a problem.

I recommend practical controls: individual credentials, documented receiving procedures, regular inventory reconciliation, independent review of cash activity, and approval requirements for adjustments, refunds, and product destruction.

Training needs to reflect what employees actually do. They should know how to respond to suspicious activity, a threatening customer, a robbery, or a security-system failure.

Finally, test the program. Retrieve footage, check alarm responses, review access permissions, and promptly investigate discrepancies. A written policy only protects the business when people follow it. I highly recommend an annual security risk assessment by an experienced third-party company. You would be surprised what they see and you don’t. 

If a state-legal cannabis cultivation were to apply to become Schedule III-registered, how would that federal registration increase the necessary security and loss prevention systems in place?

I would first clarify which federal registration pathway applies. It would be misleading to tell every state-licensed cultivator that Schedule III registration automatically requires a new vault, more cameras, or a complete security redesign.

The April 2026 federal rule created a registration pathway for qualifying state medical marijuana licensees. Under that pathway, meeting state-law physical-security requirements is considered sufficient. That makes the distinction between medical and adult-use operations, and the applicable registration category, essential.

Federal registration still brings responsibilities. The rule includes cultivation-area specifications and provisions concerning crop storage, DEA access, and federal oversight of production. Those obligations need to be evaluated against the operation’s existing procedures.

My approach would be to review the actual requirements, identify any gaps, and document how the business will meet them. The investment should follow that assessment.

As the cannabis industry expands into new state markets and sectors, how do you think that security and loss prevention will remain? Moving forward, what are some easily applicable methods those new cannabis businesses can use?

Security and loss prevention will remain essential as the industry grows. Larger operations, more locations, and more complex supply chains create more opportunities for mistakes, theft, and failures of accountability.

I expect physical security, inventory systems, transaction monitoring, and cybersecurity to become more closely connected. Businesses will need to understand both who entered a room and who changed an inventory record or authorized a payment.

For a new operator, the most useful steps are straightforward: bring security expertise into the planning process, design around actual workflows, assign responsibility, train employees, and review performance regularly.

My advice is to build a program your team can operate consistently. Buying equipment is one decision. Protecting the business is an everyday responsibility.

Thank you for joining us, Tony! For more information on Sapphire’s services, please visit its website.