In a press release published in December of 2020, CSQ announced they have added a new licensed certification body to the program: QIMA/WQS, which is a provider of independent third-party certification, inspection, and training services for the food industry.
The CSQ program is marketed as the world’s first cannabis certification to meet GFSI criteria, which is expected to get benchmarked in 2022.
The CSQ scheme is built on four standards:
Growing and Cultivation of Cannabis Plants
Manufacturing and Extraction of Cannabis
Manufacturing and Infusion of Cannabis into Food & Beverage Products
Manufacturing of Cannabis Dietary Supplements
The first CSQ certifications are expected to be awarded this month. Being a licensed certification body for the CSQ program means QIMA/WQS will conduct document evaluations as well as on-site inspections to ensure companies are meeting the CSQ standards prior to certification.
“At QIMA WQS, we see an enormous potential to support and provide quality certification to the entire cannabis supply chain. Joining CSQ and its innovative approach is an exciting step into the diversification of our services and growth,” says Mario Berard, CEO of QIMA/WQS.
In Part 3 of this series on HACCP, Critical Control Points (CCPs), validation of CCPs and monitoring of CCPs were defined. When a HACCP plan identifies the correct CCP, validates the CCP as controlling the hazard and monitors the CCP, a potential hazard is controlled in the manufacturing and packaging of cannabis-infused edibles. The food industry is big on documentation. If it’s not documented, it did not happen. The written hazard analysis, validation study and monitoring of CCPs create necessary records. It is these records that will prove to a customer, auditor or inspector that the edible is safe. Here in Part 4, more recordkeeping is added on for deviation from a CCP, verification and a recall plan.
Take Corrective Action When There Is a Deviation from a Critical Control Point
Your food safety team conducts a hazard analysis, identifies CCPs and decides on monitoring devices, frequency and who is responsible for monitoring. You create an electronic or paper record of the monitoring for every batch of edible to document critical limits were met. Despite all your good efforts, something goes wrong. Maybe you lose power. Maybe the equipment jams. Nothing is perfect when dealing with ingredients, equipment and personnel. Poop happens. Because you are prepared before the deviation, your employees know what to do. With proper training, the line worker knows what to do with the equipment, the in-process product and who to inform. In most cases the product is put on hold for evaluation, and the equipment is fixed to keep running. The choices for the product include release, rework or destroy. Every action taken needs to be recorded on a corrective action form and documents attached to demonstrate the fate of the product on hold. All the product from the batch must be accounted for through documentation. If the batch size is 100 lb, then the fate of 100 lb must be documented.
Verify Critical Control Points Are Monitored and Effective
First, verification and validation are frequently confused by the best of food safety managers. Validation was discussed as part of determining CCPs in Part 3. Validation proves that following a CCP is the right method for safety. I call validation, “one and done.” Validation is done once for a CCP; while verification is ongoing at a CCP. For example, the time and temperature for effective milk pasteurization is very well known and dairies refer to the FDA Pasteurized Milk Ordinance. Dairies do not have to prove over and over that a combination of time and temperature is effective (validation), because that has been proven.
I encourage you to do as much as you can to prepare for a recall.A CCP is monitored to prove the safety parameters are met. Pasteurization is an example of the most commonly monitored parameters of time and temperature. At a kill step like pasteurization, the employee at that station is responsible for accurate monitoring of time and temperature. The company managers and owners should feel confident that CCPs have been identified and data are being recorded to prove safety. Verification is not done by the employee at the station but by a supervisor or manager. The employee at the station is probably not a member of the food safety team that wrote the HACCP plan, but the supervisor or manager that performs verification may be. Verification is proving that what was decided by the food safety team is actually implemented and consistently done.
Verification is abundant and can be very simple. First, every record associated with a CCP is reviewed by a supervisor or manager, i.e. someone who did not create the record. This can be a simple initial and date at the bottom of the record. Every corrective action form with its associated evaluation is verified in the same way. When HACCP plans are reviewed, that is verification. Verification activities include 1) testing the concentration of a sanitizer, 2) reviewing Certificates of Analysis from suppliers, 3) a review of the packaging label and 4) all chemical and microbiological testing of ingredients and product. The HACCP plan identifies CCPs. Verification confirms that implementation is running according to the plan.
Verification is like a parent who tells their child to clean their room. The child walks to their room and later emerges to state that the room is clean. The parent can believe the word of the child, if the child has been properly trained and has a history of successfully cleaning their room. At some frequency determined by the parent, the room will get a parental visual check. This is verification. In the food industry, CCP monitoring records and corrective action must be reviewed within seven days after the record is created and preferably before the food leaves the facility. Other verification activities are done in a timely manner as determined by the company.
Write a Recall Plan
In the food industry, auditors and FDA inspectors require a written recall plan. Mock recalls are recommended and always provide learning and improvement to systems. Imagine your edible product contains sugar, and your sugar supplier notifies you that the sugar is recalled due to glass pieces. Since you are starting with the supplier, that is one step back. Your documentation of ingredients includes lot numbers, dates and quantity of sugar.You keep good records and they show you exactly how much of the recalled lot was received. Next you gather your batch records. Batches with the recalled sugar are identified, and the total amount of recalled sugar is reconciled. You label every batch of your edible with a lot code, and you identify the amount of each affected lot and the customer. You have a press release template in which you add the specific information about the recall and affected lots. You notify every customer where the affected edible was shipped with a plan to return or destroy the edible. When you notify your customers, you go one step forward.
How would your company do in this situation? I have witnessed the difficulties a company faces in a recall when I was brought in to investigate the source of a pathogen. Food safety people in my workshops who have worked through a recall tell me that it was the worst time of their life. I encourage you to do as much as you can to prepare for a recall. Here are two good resources:
Last week, Oregon Secretary of State Dennis Richardson published his office’s audit of The Oregon Liquor Control Commission (OLCC). The audit uncovered a number of inadequacies with the regulatory agency, most notably the problems with their tracking system, designed to prevent cannabis form being sold on the black market.
The report highlights the need for Oregon to implement a more robust tracking system, citing reliance on self-reporting, overall poor data quality and allowing untracked inventory for newly licensed businesses. The audit also found an insufficient number of inspectors and unresolved security issues. According to The Oregonian, the OLCC only has 18 inspectors, roughly one for every 83 licensed businesses.
Auditors also found inadequacies in the application system, saying the OLCC doesn’t monitor third-party service providers and doesn’t have a process in place for reconciling data between the licensing and tracking systems. The audit found there is a risk that decisions made for the program could be based on unreliable data. It also found a risk of unauthorized access to the systems, due to a lack of managing user accounts.
This audit’s publication is very timely. Most notably because U.S. Attorney Billy Williams, who called Oregon’s black market problem “formidable,” convened a summit this week to examine how Oregon can prevent cannabis being exported to other states. According to the Oregonian, Williams said Oregon has an “identifiable and formidable overproduction and diversion problem.” The audit’s findings highlighting security issues are also very timely, given that in the same week, Oregon’s neighbor to the North, Washington, experienced a security breach in its own tracking system.
The problems with the Oregon tracking system’s security features are numerous, the audit says. They found that the OLCC lacks a good security plan, IT assets aren’t tracked well, there are no processes to determine vulnerabilities, servers and workstations not using supported operating systems and a lack of appropriately managing antivirus solutions. “Long-standing information security issues remain unresolved, including insufficient and outdated policies and procedures necessary to safeguard information assets,” reads the report’s summary.
The audit proposes 17 recommendations for the state to bolster its regulatory oversight. Those recommendations intend to address undetected compliance violations, weaknesses in application management, IT security weaknesses and weaknesses in disaster recovery and media backup testing. You can read the full audit here.
Broken Coast Cannabis Ltd., a cannabis business located on Vancouver Island, issued a voluntary recall of three cannabis lots due to the detection of pesticides. According to the safety alert published on Health Canada’s website, the voluntary Type III recall follows an inspection of the facility back in March of this year.
A Type III recall means those products are not likely to cause negative health effects. Sampling of those three cannabis lots found a cannabis oil product in July to contain low levels of Myclobutanil and Spinosad.
Upon further testing, a cannabis leaf sample was found to contain 0.017 parts-per-million of Myclobutanil. A third party laboratory confirmed the presence of that fungicide, leading them to recall three lots of dried cannabis sold between July and December of 2016, according to that safety alert.
Spinosad, an insecticide, and Myclobutanil, a fungicide, are not authorized for use with cannabis plants per the Pest Control Products Act, however they are approved for use in food production. The health risks of ingesting either of those two chemicals are well documented. “Health Canada has not received adverse reaction reports related to Broken Coast Cannabis Ltd.’s products sold affected by the recall,” reads the safety alert. “Health Canada recommends that any individual affected by the recall immediately stop using the recalled product and to contact Broken Coast Cannabis Ltd., at the following number 1-888-486-7579.”
Denver-based Green Man Cannabis last week voluntarily recalled batches of cannabis sold to both medical patients and recreational consumers. The recall comes after the discovery of off-label pesticides during inspections in both dry-flower cannabis and infused products.
According to the Denver Department of Environmental Health (DEH), the products have labels that list an OPC License number of 403-00738, 403-00361, or 403R-00201. The cannabis in question is not a specific batch, rather, “All plant material and derived products originating from these cultivation facilities are subject to the recall.” The DEH’s statement includes contact information for the company (email: email@example.com) and the DEH Public Health Inspections Division (email: firstname.lastname@example.org or 720-913-1311).
The DEH statement does not mention which pesticides were detected or the levels at which they were detected. Christian Hagaseth, founder of Green Man Cannabis, says the chemical detected was Myclobutanil. “We had used Eagle 20 in the past, [the pesticide that contains Myclobutanil] but we stopped using it as soon as it was banned,” says Hagaseth. “The DEH found the residues in the growing environment so we immediately performed a voluntary recall.” Green Man has three cultivation facilities, one of which they suspect is contaminated from pesticides sprayed a few years ago.
As far as corrective actions being taken, Hagaseth says they are doing a thorough cleaning and sanitation in two of their grows and a complete remediation plan in the suspected contaminated grow. “This was a good learning experience- the key takeaway for us is we need to clean these environments more consistently,” says Hagaseth. “I am grateful that the system is working; public health and environmental safety are being looked after here.” Hagaseth says the facility in question was operating almost without interruption since 2009, but they adjusted and learned to implement preventative actions following the recall.
The DEH says there have been zero reports of illness related to the recall. “The possible health impact of consuming marijuana products with unapproved pesticide residues is unknown,” the statement reads. “Short and long-term health impacts may exist depending on the specific product, duration, frequency, level of exposure and route of exposure.” The DEH advises consumers that may be concerned to reach out to their physician.
The DEH performs routine inspections of cannabis infused product manufacturers and retail locations in Denver, as well as investigating complaints. “I am sorry that it happened to us, but I am happy the system is working and we are more than happy to comply,” says Hagaseth.
Strictly Necessary Cookies
Strictly Necessary Cookie should be enabled at all times so that we can save your preferences for cookie settings.
We use tracking pixels that set your arrival time at our website, this is used as part of our anti-spam and security measures. Disabling this tracking pixel would disable some of our security measures, and is therefore considered necessary for the safe operation of the website. This tracking pixel is cleared from your system when you delete files in your history.
If you disable this cookie, we will not be able to save your preferences. This means that every time you visit this website you will need to enable or disable cookies again.