The word “audit” evokes various emotions depending on your role in an organization and the context of the audit. While most are familiar with and loathe the IRS’s potential for a tax audit, the audits we are going to discuss today are (or should be) welcomed – proactive internal quality audits. A softer term that is also acceptable is “self-assessment.” These are independent assessments conducted to determine how effective an organization’s risk management, processes and general governance is. 

“How do you know where you’re going if you don’t know where you’ve been” – Maya Angelou

Internal quality audits are critical to ensuring the safety of products, workers, consumers and the environment. When planned and performed periodically, these audits provide credible, consistent and objective evidence to inform the organization of its risks, weaknesses and opportunities for improvement. Ask yourself the question: do your clients/vendors rely on you to produce reliable, consistent and safe products? Assuming the answer is yes, what confidence do you have, and where is the documented evidence to support it?

Compliance units within cannabis businesses are typically responsible for ensuring a business stays legally compliant with state and federal regulations. This level of minimum compliance is critical to prevent fines and ensure licenses are not revoked. However, compliance audits rarely include fundamental components that leave cannabis operators exposed to many unnecessary risks.

As a producer of medical and adult-use products that are ingested, inhaled or consumed in other forms by our friends, family and neighbors, how can you be sure that these products are produced safely and consistently? Are you confident that the legal requirements mandated by your state cannabis control board are sufficient? Judging by the number of recalls and frustrations voiced by the industry regarding the myriad of regulations, I would bet the answer is no.

What questions do internal audits address? Some examples include:

• Are you operating as management intends?
• How effective is your system in meeting specified objectives? These objectives could include quality metrics of your products, on-time delivery rates and other client/customer satisfaction metrics.
• Are there opportunities to improve?
• Are you doing what you say you do (in your SOPs), and do you have the recorded evidence (records) to prove it?
• Are you meeting the requirements of all applicable government regulations?

There are potential drawbacks to internal audits. For one, as impartiality is essential in internal audits, it may be challenging to identify an impartial internal auditor in a small operation. If your team always feels like it is in firefighting mode, it may feel like a luxury to take the time to pull members out of their day-to-day duties and disrupt ongoing operations for an audit. Some fear that as internal assessments are meant to be more thorough than external assessments, a laundry list of to-do items may be uncovered due to the audit. But, these self-assessments often uncover issues that have resulted in operational efficiencies in the first place. This resulting “laundry list” then affords a proactive tool to implement corrective actions in an organized manner that can prevent the recurrence of major issues, as well as prevent new issues. The benefits of internal audits outweigh the drawbacks; not to mention, conducting internal audits is required by nearly every globally-recognized program, both voluntary (e.g. ISO 9001 or ASTM Internationals’s Cannabis Certification Program) and government required programs such as 21 CFR 211 for Pharmaceuticals.

Internal Auditing is a catalyst for improving an organization’s effectiveness and efficiency by providing insight and recommendations based on analyses and assessments of data and business processes. Additional benefits of internal audits include giving your organization the means to:

• Ensure compliance to the requirements of internal, international and industry standards as well as regulations and customer requirements
• Determine the effectiveness of the implemented system in meeting specified objectives (quality, environmental, financial)
• Explore opportunities for improvement
• Meet statutory and regulatory requirements
• Provide feedback to Top Management
• Lower the cost of poor quality

Findings from all audits must be addressed. This is typically done in accordance with a CAPA (Corrective Action Preventive Action) program. To many unfamiliar with Quality Management Systems, this may be a new term. As of Jan 1, 2021, this is now a requirement for all cannabis licensed operators in Colorado. Many other states require a CAPA program or similar. Continuing education units (CEUs) are available through ASTM International’s CAPA training program, which was developed specifically for the cannabis industry.

Examples of common audit findings that require CAPAs include:

• Calibration – Production and test equipment must be calibrated to ensure they provide accurate and repeatable results.
• Document and record control – Documents and records need to be readily accessible but protected from unintended use.
• Supplier management – Most standards have various requirements for supplier management that may include auditing suppliers, monitoring supplier performance, only using suppliers certified to specific standards, etc.
• Internal audits – Believe it or not, since internal audits are required by many programs, it’s not uncommon to have a finding related to internal audits! Findings from an internal audit can include not conducting audits on schedule, not addressing audit findings or not having a properly qualified internal auditor. Are you looking for more guidance? Last year, members of ASTM International’s D37 Committee on Cannabis approved a Standard Guide for Cannabis and Hemp Operation Compliance Audits, ASTM D8308-21.

If you are still on the fence about the value of an internal audit, given the option of an inspector uncovering a non-conformance or your own team discovering and then correcting it, which would you prefer? With fines easily exceeding $100,000 by many cannabis enforcement units, the answer should be clear. Internal audits are a valuable tool that should not be feared.