Tag Archives: inspection

By Dede Perkins

If you’re a licensed cannabis operator and you don’t make peace with state and local inspectors visiting your facility, clipboard or tablet in hand, you’re in for a long and likely bumpy road. All kinds of authorities will want to inspect your cannabis operation and facility. There will be state regulatory inspections, inspections driven by insurance and banking partners, local code officials, OSHA, EPA, and more. On average, cannabis operators are visited one to two times each year for state inspections, one time for insurance purposes, and one time for banking purposes. Depending on the reason for the visit, cannabis operators can expect inspectors to be onsite for varying amounts of time — an hour if the inspection concerns insurance, banking, or local codes (electrical, mechanical, plumbing, fire suppression and alarm systems); depending on the license type, two to four hours for a preoperational inspection, and four hours when OSHA comes to call. If an inspector shows up unannounced in response to a complaint or possible violation, be prepared for a four- to eight-hour stay.

In this article, we will focus on how to prepare for the three types of state regulatory inspections: pre-operational, unannounced, and renewal. However, the basics of preparing for a state regulatory inspection apply to all inspections. To begin, let’s define the reason behind each type of state regulatory inspection and highlight the most common items you’ll need to provide/show the inspector.

Pre-operational

Every licensed operator must pass a state pre-operational inspection before opening for business. In most states, the regulator assigned to the licensee will provide instructions on what to expect and the requirements to pass the inspection. Preparing ahead of time and showing the inspector that you and your staff take compliance and safety seriously will go a long way toward making the inspection speedier and smoother, which of course means you can start making money sooner.

At a minimum, to pass your pre-operational inspection, you need to have an organized binder or software program with all required documentation. Depending on your state, you will likely need:

Floor plans
Training plans
Standard operating procedures (SOPs) to:
- Track inventory to prevent diversion and inversion
- Store and display inventory
- Control access to areas where cannabis is displayed or stored
- Check IDs to prevent underage purchases
- Maintain a safe and sanitary facility
- Handle all facility operations
- Handle adverse events
Security systems
- Alarms, surveillance cameras
- Safe and timely storage of video recordings
- Equipment maintenance procedures
MSDS sheets for chemicals used during operations, if applicable
Administrative requirements such as insurance policies, surety bonds, corporate documentation, management and other legal contracts

In addition to reviewing required documentation, the inspector will tour your facility to ensure submitted floor plans are accurate and the building, security equipment and controls, signage, lighting, and access control are all compliant, and your license is displayed in a readily visible location.

Surprise/Unannounced Inspection

If an inspector shows up unannounced to your cannabis facility, it’s likely in response to a tip of non-compliance or complaint(s) from a customer or neighboring business.

To prepare for the unexpected, it’s best to be organized. Set up compliant systems to manage your operations before you have a problem. Have an organized binder or software program with all required documentation to prove you are proactive and your operations are compliant.

Set up a system to track the following:

Sales and inventory records
Employee onboarding; training documentation
Security equipment and system maintenance
Opening and closing procedures
Sanitation and safety for people and products
Environmental impacts, odor mitigation
Advertising, marketing campaigns
Packaging and labeling procedures and protocols
Mandatory testing results, product certificate of analysis (COAs)
Chain of custody documentation
Access control for employees, visitors, and to ensure underage individuals are not able to purchase cannabis or cannabis products
Administrative requirements

Ask your regulatory representative if there is a checklist you can use to ensure your operations are compliant, so you’ll always be prepared — even for a surprise inspection.

Renewal Inspection

The purpose of a renewal inspection is threefold. They are designed to ensure:

You’re doing what you said you’d do in your original license application.
Your procedures remain compliant, and your recordkeeping is in order.
You haven’t changed your facility or operations without first obtaining state approval.

License renewal applications are often time-consuming and challenging, especially if you haven’t set up a compliance system with an organized binder or software portal where information is readily available. To prepare for your renewal inspection, you’ll need everything listed in the pre-operational and surprise inspections as well as required annual reports such as your company’s diversity, community, and environmental impacts.

How to Prepare for All State Inspections

There are a few best practices that will help you impress your state inspector and ultimately avoid deficiency notices and fines. With a little preparation, you will feel confident and be able to greet your cannabis inspector with a smile and welcoming demeanor, which will set the tone for a pain-free inspection.

The first thing to do is to set up easily accessible and accurate recordkeeping systems as early in your business lifecycle as possible. Make sure facility managers or shift leads know where to find and how to share state-required documentation.

Ed Windbigler, Director of Internal Operations at Fawn River Cultivation Company in Michigan said, “I normally have all the administrative requirements pre-printed — visitor logs, color photos from 30 days earlier, background checks, SOPs, etc., all ready for the state inspector.”

The second is to maintain a clean and safe facility. Regularly walk through your facility and ensure that it, and all equipment in it, is clean, and that product is correctly displayed and stored. Ensure your license is displayed in a prominent location.

The third is to talk with your staff and let them know you prioritize compliance and an inspection is not a reason to panic. Appoint one person (or one in each area of the facility if your facility is large) to show the inspector around and respond to any questions or requests for information. Let your staff know what to expect. Make sure they know the regulations that apply to their position, where to find their department’s standard operating procedures, how to alert management if they witness a non-compliant activity or part of the facility, how to respond to a threat such as theft (co-worker or customer), altercation or aggressive behavior, fire, or natural disaster. Consider role-playing so employees can get comfortable with the types of questions an inspector may ask.

When asked how he prepares employees for an inspection, Windbigler, who has implemented a regular system of internal audits said, “We really don’t have our employees do anything differently. Our internal audits normally catch any issues early on.”

Fourth, walk through your facility with an eye toward security. Andy Shelley, former Oregon cannabis inspector and founder/CEO of CannXperts, a cannabis compliance consulting firm, suggests having an employee walk through the site while another monitors the surveillance. Adjust cameras or install additional cameras to cover blind spots. Check that surveillance recordings are stored in a manner that complies with state requirements. Ensure areas of the facility that contain cannabis or cannabis products are properly access-controlled. Check that facility visitor logs are complete and compliant with the regulations.

“I would say, consistently, the state inspectors will focus more attention on surveillance and security above everything else. You want to make sure those systems are rock solid. We train one or two onsite employees to check the systems daily and weekly and then we perform a complete compliance inspection on those systems during our audits,” said Shelley.

Jacob Lawson, Compliance Specialist, and Sarah Stalker, Director of Compliance at JARS in Arizona, said, “We focus equally on all aspects of compliance including but not limited to security, inventory, safety, and sanitation. We expect the state to always look at all aspects of compliance.”

And fifth, regularly audit your facility, staff, and operations to identify areas of weakness or non-compliance. Some states publish checklists that inspectors use when visiting a facility; if yours does, use it! Consultants and operational platforms often have their own checklists based on state rules and regulations. If you have an existing relationship, see if they have a resource you can use to prepare for your inspection.

Shelley advises, “Check everything, then double-check everything and then check it all again. There is no better way to test your compliance systems than having fresh eyes inspecting you a couple of times a year. We rotate our inspectors, so they aren’t going to the same facility twice in a row; so even we are putting fresh eyes on a client’s operations each time. Complacency can destroy an otherwise healthy company.”

Here’s to compliant cannabis facilities, and safe, life-changing cannabis and cannabis products. You’ve got this!

January 12, 2021

QIMA/WQS to Audit Cannabis Companies as CSQ Certification Body

By Cannabis Industry Journal Staff

No Comments

Back in July of 2020, ASI Global Standards announced the launch of their newest audit standard: The Cannabis Safety & Quality Scheme (CSQ). The scheme is built around ISO requirements and the Global Food Safety Initiative (GFSI) requirements.

In a press release published in December of 2020, CSQ announced they have added a new licensed certification body to the program: QIMA/WQS, which is a provider of independent third-party certification, inspection, and training services for the food industry.

The CSQ program is marketed as the world’s first cannabis certification to meet GFSI criteria, which is expected to get benchmarked in 2022.

The CSQ scheme is built on four standards:

Growing and Cultivation of Cannabis Plants
Manufacturing and Extraction of Cannabis
Manufacturing and Infusion of Cannabis into Food & Beverage Products
Manufacturing of Cannabis Dietary Supplements

The first CSQ certifications are expected to be awarded this month. Being a licensed certification body for the CSQ program means QIMA/WQS will conduct document evaluations as well as on-site inspections to ensure companies are meeting the CSQ standards prior to certification.

“At QIMA WQS, we see an enormous potential to support and provide quality certification to the entire cannabis supply chain. Joining CSQ and its innovative approach is an exciting step into the diversification of our services and growth,” says Mario Berard, CEO of QIMA/WQS.

May 31, 2018

Hazard Analysis and Critical Control Points (HACCP) for the Cannabis Industry: Part 4

By Kathy Knutson, Ph.D.

No Comments

In Part 3 of this series on HACCP, Critical Control Points (CCPs), validation of CCPs and monitoring of CCPs were defined. When a HACCP plan identifies the correct CCP, validates the CCP as controlling the hazard and monitors the CCP, a potential hazard is controlled in the manufacturing and packaging of cannabis-infused edibles. The food industry is big on documentation. If it’s not documented, it did not happen. The written hazard analysis, validation study and monitoring of CCPs create necessary records. It is these records that will prove to a customer, auditor or inspector that the edible is safe. Here in Part 4, more recordkeeping is added on for deviation from a CCP, verification and a recall plan.

Take Corrective Action When There Is a Deviation from a Critical Control Point

Your food safety team conducts a hazard analysis, identifies CCPs and decides on monitoring devices, frequency and who is responsible for monitoring. You create an electronic or paper record of the monitoring for every batch of edible to document critical limits were met. Despite all your good efforts, something goes wrong. Maybe you lose power. Maybe the equipment jams. Nothing is perfect when dealing with ingredients, equipment and personnel. Poop happens. Because you are prepared before the deviation, your employees know what to do. With proper training, the line worker knows what to do with the equipment, the in-process product and who to inform. In most cases the product is put on hold for evaluation, and the equipment is fixed to keep running. The choices for the product include release, rework or destroy. Every action taken needs to be recorded on a corrective action form and documents attached to demonstrate the fate of the product on hold. All the product from the batch must be accounted for through documentation. If the batch size is 100 lb, then the fate of 100 lb must be documented.

Verify Critical Control Points Are Monitored and Effective

First, verification and validation are frequently confused by the best of food safety managers. Validation was discussed as part of determining CCPs in Part 3. Validation proves that following a CCP is the right method for safety. I call validation, “one and done.” Validation is done once for a CCP; while verification is ongoing at a CCP. For example, the time and temperature for effective milk pasteurization is very well known and dairies refer to the FDA Pasteurized Milk Ordinance. Dairies do not have to prove over and over that a combination of time and temperature is effective (validation), because that has been proven.

I encourage you to do as much as you can to prepare for a recall.A CCP is monitored to prove the safety parameters are met. Pasteurization is an example of the most commonly monitored parameters of time and temperature. At a kill step like pasteurization, the employee at that station is responsible for accurate monitoring of time and temperature. The company managers and owners should feel confident that CCPs have been identified and data are being recorded to prove safety. Verification is not done by the employee at the station but by a supervisor or manager. The employee at the station is probably not a member of the food safety team that wrote the HACCP plan, but the supervisor or manager that performs verification may be. Verification is proving that what was decided by the food safety team is actually implemented and consistently done.

Verification is abundant and can be very simple. First, every record associated with a CCP is reviewed by a supervisor or manager, i.e. someone who did not create the record. This can be a simple initial and date at the bottom of the record. Every corrective action form with its associated evaluation is verified in the same way. When HACCP plans are reviewed, that is verification. Verification activities include 1) testing the concentration of a sanitizer, 2) reviewing Certificates of Analysis from suppliers, 3) a review of the packaging label and 4) all chemical and microbiological testing of ingredients and product. The HACCP plan identifies CCPs. Verification confirms that implementation is running according to the plan.

Verification is like a parent who tells their child to clean their room. The child walks to their room and later emerges to state that the room is clean. The parent can believe the word of the child, if the child has been properly trained and has a history of successfully cleaning their room. At some frequency determined by the parent, the room will get a parental visual check. This is verification. In the food industry, CCP monitoring records and corrective action must be reviewed within seven days after the record is created and preferably before the food leaves the facility. Other verification activities are done in a timely manner as determined by the company.

Food processing and sanitation — Product recalls due to manufacturing errors in sanitation cause mistrust among consumers.

Write a Recall Plan

In the food industry, auditors and FDA inspectors require a written recall plan. Mock recalls are recommended and always provide learning and improvement to systems. Imagine your edible product contains sugar, and your sugar supplier notifies you that the sugar is recalled due to glass pieces. Since you are starting with the supplier, that is one step back. Your documentation of ingredients includes lot numbers, dates and quantity of sugar.You keep good records and they show you exactly how much of the recalled lot was received. Next you gather your batch records. Batches with the recalled sugar are identified, and the total amount of recalled sugar is reconciled. You label every batch of your edible with a lot code, and you identify the amount of each affected lot and the customer. You have a press release template in which you add the specific information about the recall and affected lots. You notify every customer where the affected edible was shipped with a plan to return or destroy the edible. When you notify your customers, you go one step forward.

How would your company do in this situation? I have witnessed the difficulties a company faces in a recall when I was brought in to investigate the source of a pathogen. Food safety people in my workshops who have worked through a recall tell me that it was the worst time of their life. I encourage you to do as much as you can to prepare for a recall. Here are two good resources:

Chapter 15 in the Participant Manual of the Preventive Controls for Human Food rule Warning! The manual is over 500 pages, so be careful what you print. It can be purchased for only $30 by following the link to the bookstore.

The Food Recall Manual of the University of Florida Extension Another warning! The manual is 134 pages.

Please comment on this blog post below. I love feedback!

February 12, 2018

Audit Finds Oregon Lacking Regulatory Oversight and Proper Security

By Aaron G. Biros

No Comments

Last week, Oregon Secretary of State Dennis Richardson published his office’s audit of The Oregon Liquor Control Commission (OLCC). The audit uncovered a number of inadequacies with the regulatory agency, most notably the problems with their tracking system, designed to prevent cannabis form being sold on the black market.

The report highlights the need for Oregon to implement a more robust tracking system, citing reliance on self-reporting, overall poor data quality and allowing untracked inventory for newly licensed businesses. The audit also found an insufficient number of inspectors and unresolved security issues. According to The Oregonian, the OLCC only has 18 inspectors, roughly one for every 83 licensed businesses.

Auditors also found inadequacies in the application system, saying the OLCC doesn’t monitor third-party service providers and doesn’t have a process in place for reconciling data between the licensing and tracking systems. The audit found there is a risk that decisions made for the program could be based on unreliable data. It also found a risk of unauthorized access to the systems, due to a lack of managing user accounts.

Oregon Secretary of State Dennis Richardson

This audit’s publication is very timely. Most notably because U.S. Attorney Billy Williams, who called Oregon’s black market problem “formidable,” convened a summit this week to examine how Oregon can prevent cannabis being exported to other states. According to the Oregonian, Williams said Oregon has an “identifiable and formidable overproduction and diversion problem.” The audit’s findings highlighting security issues are also very timely, given that in the same week, Oregon’s neighbor to the North, Washington, experienced a security breach in its own tracking system.

The problems with the Oregon tracking system’s security features are numerous, the audit says. They found that the OLCC lacks a good security plan, IT assets aren’t tracked well, there are no processes to determine vulnerabilities, servers and workstations not using supported operating systems and a lack of appropriately managing antivirus solutions. “Long-standing information security issues remain unresolved, including insufficient and outdated policies and procedures necessary to safeguard information assets,” reads the report’s summary.

The audit proposes 17 recommendations for the state to bolster its regulatory oversight. Those recommendations intend to address undetected compliance violations, weaknesses in application management, IT security weaknesses and weaknesses in disaster recovery and media backup testing. You can read the full audit here.

August 31, 2017

Canadian Company Recalls Contaminated Cannabis

By Aaron G. Biros

No Comments

Broken Coast Cannabis Ltd., a cannabis business located on Vancouver Island, issued a voluntary recall of three cannabis lots due to the detection of pesticides. According to the safety alert published on Health Canada’s website, the voluntary Type III recall follows an inspection of the facility back in March of this year.

A Type III recall means those products are not likely to cause negative health effects. Sampling of those three cannabis lots found a cannabis oil product in July to contain low levels of Myclobutanil and Spinosad.

Upon further testing, a cannabis leaf sample was found to contain 0.017 parts-per-million of Myclobutanil. A third party laboratory confirmed the presence of that fungicide, leading them to recall three lots of dried cannabis sold between July and December of 2016, according to that safety alert.

Spinosad, an insecticide, and Myclobutanil, a fungicide, are not authorized for use with cannabis plants per the Pest Control Products Act, however they are approved for use in food production. The health risks of ingesting either of those two chemicals are well documented. “Health Canada has not received adverse reaction reports related to Broken Coast Cannabis Ltd.’s products sold affected by the recall,” reads the safety alert. “Health Canada recommends that any individual affected by the recall immediately stop using the recalled product and to contact Broken Coast Cannabis Ltd., at the following number 1-888-486-7579.”

January 23, 2017

Green Man Cannabis Recalls Due to Pesticide Residue Detection

By Aaron G. Biros

2 Comments

Denver-based Green Man Cannabis last week voluntarily recalled batches of cannabis sold to both medical patients and recreational consumers. The recall comes after the discovery of off-label pesticides during inspections in both dry-flower cannabis and infused products.

According to the Denver Department of Environmental Health (DEH), the products have labels that list an OPC License number of 403-00738, 403-00361, or 403R-00201. The cannabis in question is not a specific batch, rather, “All plant material and derived products originating from these cultivation facilities are subject to the recall.” The DEH’s statement includes contact information for the company (email: recall@greenmancannabis.com) and the DEH Public Health Inspections Division (email: phicomments@denvergov.org or 720-913-1311).

The DEH statement does not mention which pesticides were detected or the levels at which they were detected. Christian Hagaseth, founder of Green Man Cannabis, says the chemical detected was Myclobutanil. “We had used Eagle 20 in the past, [the pesticide that contains Myclobutanil] but we stopped using it as soon as it was banned,” says Hagaseth. “The DEH found the residues in the growing environment so we immediately performed a voluntary recall.” Green Man has three cultivation facilities, one of which they suspect is contaminated from pesticides sprayed a few years ago.

Christian Hageseth, founder of Green Man Cannabis

As far as corrective actions being taken, Hagaseth says they are doing a thorough cleaning and sanitation in two of their grows and a complete remediation plan in the suspected contaminated grow. “This was a good learning experience- the key takeaway for us is we need to clean these environments more consistently,” says Hagaseth. “I am grateful that the system is working; public health and environmental safety are being looked after here.” Hagaseth says the facility in question was operating almost without interruption since 2009, but they adjusted and learned to implement preventative actions following the recall.

The DEH says there have been zero reports of illness related to the recall. “The possible health impact of consuming marijuana products with unapproved pesticide residues is unknown,” the statement reads. “Short and long-term health impacts may exist depending on the specific product, duration, frequency, level of exposure and route of exposure.” The DEH advises consumers that may be concerned to reach out to their physician.

The DEH performs routine inspections of cannabis infused product manufacturers and retail locations in Denver, as well as investigating complaints. “I am sorry that it happened to us, but I am happy the system is working and we are more than happy to comply,” says Hagaseth.