Tag Archives: require

June 9, 2021

How Effective is Your Internal Auditing Program?

By David Vaillencourt

The word “audit” evokes various emotions depending on your role in an organization and the context of the audit. While most are familiar with and loathe the IRS’s potential for a tax audit, the audits we are going to discuss today are (or should be) welcomed – proactive internal quality audits. A softer term that is also acceptable is “self-assessment.” These are independent assessments conducted to determine how effective an organization’s risk management, processes and general governance is.

“How do you know where you’re going if you don’t know where you’ve been” – Maya Angelou

Internal quality audits are critical to ensuring the safety of products, workers, consumers and the environment. When planned and performed periodically, these audits provide credible, consistent and objective evidence to inform the organization of its risks, weaknesses and opportunities for improvement. Ask yourself the question: do your clients/vendors rely on you to produce reliable, consistent and safe products? Assuming the answer is yes, what confidence do you have, and where is the documented evidence to support it?

Compliance units within cannabis businesses are typically responsible for ensuring a business stays legally compliant with state and federal regulations. This level of minimum compliance is critical to prevent fines and ensure licenses are not revoked. However, compliance audits rarely include fundamental components that leave cannabis operators exposed to many unnecessary risks.

As a producer of medical and adult-use products that are ingested, inhaled or consumed in other forms by our friends, family and neighbors, how can you be sure that these products are produced safely and consistently? Are you confident that the legal requirements mandated by your state cannabis control board are sufficient? Judging by the number of recalls and frustrations voiced by the industry regarding the myriad of regulations, I would bet the answer is no.

What questions do internal audits address? Some examples include:

Are you operating as management intends?
How effective is your system in meeting specified objectives? These objectives could include quality metrics of your products, on-time delivery rates and other client/customer satisfaction metrics.
Are there opportunities to improve?
Are you doing what you say you do (in your SOPs), and do you have the recorded evidence (records) to prove it?
Are you meeting the requirements of all applicable government regulations?

There are potential drawbacks to internal audits. For one, as impartiality is essential in internal audits, it may be challenging to identify an impartial internal auditor in a small operation. If your team always feels like it is in firefighting mode, it may feel like a luxury to take the time to pull members out of their day-to-day duties and disrupt ongoing operations for an audit. Some fear that as internal assessments are meant to be more thorough than external assessments, a laundry list of to-do items may be uncovered due to the audit. But, these self-assessments often uncover issues that have resulted in operational efficiencies in the first place. This resulting “laundry list” then affords a proactive tool to implement corrective actions in an organized manner that can prevent the recurrence of major issues, as well as prevent new issues. The benefits of internal audits outweigh the drawbacks; not to mention, conducting internal audits is required by nearly every globally-recognized program, both voluntary (e.g. ISO 9001 or ASTM Internationals’s Cannabis Certification Program) and government required programs such as 21 CFR 211 for Pharmaceuticals.

Internal Auditing is a catalyst for improving an organization’s effectiveness and efficiency by providing insight and recommendations based on analyses and assessments of data and business processes. Additional benefits of internal audits include giving your organization the means to:

Ensure compliance to the requirements of internal, international and industry standards as well as regulations and customer requirements
Determine the effectiveness of the implemented system in meeting specified objectives (quality, environmental, financial)
Explore opportunities for improvement
Meet statutory and regulatory requirements
Provide feedback to Top Management
Lower the cost of poor quality

Findings from all audits must be addressed. This is typically done in accordance with a CAPA (Corrective Action Preventive Action) program. To many unfamiliar with Quality Management Systems, this may be a new term. As of Jan 1, 2021, this is now a requirement for all cannabis licensed operators in Colorado. Many other states require a CAPA program or similar. Continuing education units (CEUs) are available through ASTM International’s CAPA training program, which was developed specifically for the cannabis industry.

Examples of common audit findings that require CAPAs include:

Calibration – Production and test equipment must be calibrated to ensure they provide accurate and repeatable results.
Document and record control – Documents and records need to be readily accessible but protected from unintended use.
Supplier management – Most standards have various requirements for supplier management that may include auditing suppliers, monitoring supplier performance, only using suppliers certified to specific standards, etc.
Internal audits – Believe it or not, since internal audits are required by many programs, it’s not uncommon to have a finding related to internal audits! Findings from an internal audit can include not conducting audits on schedule, not addressing audit findings or not having a properly qualified internal auditor. Are you looking for more guidance? Last year, members of ASTM International’s D37 Committee on Cannabis approved a Standard Guide for Cannabis and Hemp Operation Compliance Audits, ASTM D8308-21.

If you are still on the fence about the value of an internal audit, given the option of an inspector uncovering a non-conformance or your own team discovering and then correcting it, which would you prefer? With fines easily exceeding $100,000 by many cannabis enforcement units, the answer should be clear. Internal audits are a valuable tool that should not be feared.

May 22, 2019

Arizona Still Doesn’t Require Lab Testing, But That Could Change Soon

By Aaron G. Biros

2 Comments

As of today, Arizona is the only state in the country that has legalized medical cannabis but does not require producers to test their medical cannabis. States throughout the country that legalize medical cannabis routinely implement regulations that require third-party, independent lab testing to protect patient and consumer safety. Arizona legalized medical cannabis for a number of qualifying conditions back in 2011, but still has no measure like other states to protect patient safety.

Lawmakers in Arizona now have the opportunity to change that with SB1494, which passed unanimously through the state’s Senate back in March of 2019. According to the Arizona Cannabis Laboratory Association (ACLA), the bill awaits action in the House of Representatives. The ACLA says in a press release that “supporters of the bill are calling on lawmakers to move on a bill that unanimously passed in the Senate earlier this year.” The bill would require producers to use independent, third-party labs to test cannabis for things like harmful toxins and molds.

Ryan Tracy, co-founder of the ACLA and founder/CEO at C4 Labs.

According to Ryan Treacy, co-founder of the ACLA and CEO/Founder of C4 Laboratories, the ACLA was formed for a few important reasons: “We feel it is very important that we encourage and cultivate a professional and collaborative rapport among the reputable Arizona cannabis labs,” says Treacy. “So that we can call upon the collective groups’ years of experience to help provide insight and suggestions on how we as a group can insure the most accurate and consistent results for our clients throughout the state and ultimately their patients.” Treacy went on to add that it is particularly important their collective voice be heard at the State Capitol as lawmakers work towards passing SB 1494.

“There isn’t any reason to wait for someone to get sick before the legislature passes this bipartisan bill. Let’s get it done!”George Griffeth, President of the ACLA, says there is a sense of urgency in passing this bill before the voters decide on legalizing recreational adult-use cannabis next year. “Everyone agrees that now is the time to be proactive to protect patients from unsafe contaminants,” says Griffeth. “Currently 61 tons of medical marijuana is consumed by patients and many believe that the number of people using the medicine will continue to grow. With a ballot initiative related to the recreational use of marijuana facing voters next year, Arizona must act now to make sure standards are in place.”

They say the bill has bipartisan support and many stakeholders in Arizona’s cannabis industry express support for it as well. For Ryan Treacy, he is worried about patients consuming harmful chemicals and toxins. “My colleagues and I are deeply concerned that more than two-hundred thousand people who use medical marijuana could be inadvertently exposing themselves to toxic chemicals, E. Coli, Salmonella or mold,” says Treacy. “There isn’t any reason to wait for someone to get sick before the legislature passes this bipartisan bill. Let’s get it done!”

Treacy says this bill is particularly difficult to pass because the original measure to legalize medical cannabis was a ballot initiative. That means the bill needs 75% support in both the House and the Senate in order to amend the original measure. “The passing of this bill would be a huge win for the patients and will help to ensure honesty and transparency for those that operate in the current medical cannabis program here in AZ,” says Treacy. “This testing bill is also written with legislative intent to cover any and all future adult use or recreational use legislative laws or ballot initiatives. We hope to have a final verdict on this bill by end of this week or early next.”

February 13, 2018

Hazard Analysis and Critical Control Points (HACCP) for the Cannabis Industry: Part 1

By Kathy Knutson, Ph.D.

1 Comment

Hazard Analysis and Critical Control Points (HACCP) Defined

Farm-to-fork is a concept to describe the control of food safety starting in the fields of a farm and ending with deliciousness in my mouth. The more that is optimized at every step, the more food safety and quality are realized. Farm-to-fork is not a concept reserved for foodies or “eat local” food campaigns and applies to all scales of food manufacture. HACCP is like putting the last piece of a huge puzzle in the middle and seeing the whole picture develop. HACCP is a program to control food safety at the step of food processing. In states where cannabis is legal, the state department of public health or state department of agriculture may require food manufacturers to have a HACCP plan. The HACCP plan is a written document identifying food safety hazards and how those hazards are controlled by the manufacturer. While there are many resources available for writing a HACCP plan, like solving that puzzle, it is a do-it-yourself project. You can’t use someone else’s “puzzle,” and you can’t put the box on a shelf and say you have a “puzzle.”

HACCP is pronounced “ha” as in “hat” plus “sip.”

(Say it aloud.)

3-2-1 We have liftoff.

The history of HACCP starts not with Adam eating in the garden of Eden but with the development of manned missions to the moon, the race to space in the 1950s. Sorry to be gross, but imagine an astronaut with vomiting and diarrhea as a result of foodborne illness. In the 1950s, the food industry relied on finished product testing to determine safety. Testing is destructive of product, and there is no amount of finished product testing that will determine food is safe enough for astronauts. Instead, the food industry built safety into the process. Temperature was monitored and recorded. Acidity measured by pH is an easy test. Rather than waiting to test the finished product in its sealed package, the food industry writes specifications for ingredients, ensures equipment is clean and sanitized, and monitors processing and packaging. HACCP was born first for astronauts and now for everyone.

HACCP is not the only food safety program.

If you are just learning about HACCP, it is a great place to start! There is a big world of food safety programs. HACCP is required by the United States Department of Agriculture for meat processors. The Food and Drug Administration (FDA) requires HACCP for seafood processing and 100% juice manufacture. For all foods beyond meat, seafood and juice, FDA has the Food Safety Modernization Act (FSMA) to enforce food safety. FSMA was signed in 2011 and became enforceable for companies with more than 500 employees in September of 2016; all food companies are under enforcement in September 2018. FSMA requires all food companies with an annual revenue greater than $1 million to follow a written food safety plan. Both FDA inspectors and industry professionals are working to meet the requirements of FSMA. There are also national and international guidelines for food safety with elements of HACCP which do not carry the letter of law.

The first step in HACCP is a hazard analysis.

Traditionally HACCP has focused on processing and packaging. Your organization may call that manufacturing or operations. In a large facility there is metering of ingredients by weight or volume and mixing. A recipe or batch sheet is followed. Most, but not all, products have a kill step where high heat is applied through roasting, baking, frying or canning. The food is sealed in packaging, labeled, boxed and heads out for distribution. For your hazard analysis, you identify the potential hazards that could cause injury or illness, if not controlled during processing. Think about all the potential hazards:

Biological: What pathogens are you killing in the kill step? What pathogens could get in to the product before packaging is sealed?

Chemical: Pesticides, industrial chemicals, mycotoxins and allergens are concerns.

Physical: Evaluate the potential for choking hazards and glass, wood, hard plastic and metal.

The hazards analysis drives everything you do for food safety.

I cannot emphasize too much the importance of the hazard analysis. Every food safety decision is grounded in the hazard analysis. Procedures will be developed and capital will be purchased based on the hazard analysis and control of food safety in your product. There is no one form for the completion of a hazard analysis.

HACCP risk matrix — A risk severity matrix. Many HACCP training programs have these.

So where do you start? Create a flow diagram naming all the steps in processing and packaging. If your flow diagram starts with Receiving of ingredients, then the next step is Storage of ingredients; include packaging with Receiving and Storage. From Storage, ingredients and packaging are gathered for a batch. Draw out the processing steps in order and through to Packaging. After Packaging, there is finished product Storage and Distribution. Remember HACCP focuses on the processing and packaging steps. It is not necessary to detail each step on the flow diagram, just name the step, e.g. Mixing, Filling, Baking, etc. Other supporting documents have the details of each step.

For every step on the flow diagram, identify hazards.

Transfer the name of the step to the hazard analysis form of your choice. Focus on one step at a time. Identify biological, chemical and physical hazards, if any, at that step. The next part is tricky. For each hazard identified, determine the probability of the hazard occurring and severity of illness or injury. Some hazards are easy like allergens. If you have an ingredient that contains an allergen, the probability is high. Because people can die from ingestion of allergens when allergic, the severity is high. Allergens are a hazard you must control. What about pesticides? What is the probability and severity? I can hear you say that you are going to control pesticides through your purchasing agreements. Great! Pesticides are still a hazard to identify in your hazard analysis. What you do about the hazard is up to you.

October 18, 2017

Ask The Expert: Exploring Cannabis Laboratory Accreditation Part 2

By Aaron G. Biros

1 Comment

In the first part of this series, Michelle Bradac, senior accreditation officer at the American Association for Laboratory Accreditation (A2LA), told us about the basics of laboratory accreditation, what it means and why it is such a cornerstone of product safety. In this next piece, we sit down with Roger Brauninger, A2LA Biosafety Program manager, to learn why states are looking to lab accreditation in their regulations for the cannabis industry.

Brauninger has worked at A2LA since 1999. As the manager of their biosafety program, his focus is on developing and maintaining accreditation programs in the life sciences. Brauninger has conducted a number of management system assessments to ISO/IEC 17025 and 17020 and also evaluates other assessors in this role.

Roger Brauninger, A2LA biosafety program manager

He is A2LA’s point person for interacting with organizations working with food and drug safety, human and animal anti-doping, biological and chemical threat agents and since 2014 for issues related to cannabis testing. He is a member of the ASTM D37 Cannabis committee, a group focused on creating standards for cannabis products. He was also a member of the stakeholder panel on strategic food analytical methods (SPSFAM) cannabis potency working group when they were awarded the Official Methods Board (OMB) award for achievement in technical and scientific excellence at the AOAC’s Annual Meeting and Exposition in Atlanta, GA. Brauninger holds an M.S. degree in Cellular, Microbial and Molecular Biology from George Mason University and is a member of the Society for Toxicology, AOAC International and the International Association for Food Protection (IAFP).

In this part of the series, we sit down with Brauninger to learn specific requirements in states, some of the benefits of using ISO/IEC 17025 and the influx of start-up or novice testing laboratories. Stay tuned for part three.

CannabisIndustryJournal: Do all states with legalized medical cannabis require the testing to be performed by an ISO/IEC 17025 accredited laboratory?

Roger Brauninger: No not at present, while most of the states where cannabis is legal do require accreditation; there are some states that have no requirements dealing with ensuring the competence of the testing laboratories, some that require the labs to be accredited to state environmental and drinking water standards, some that require laboratories adhere to Good Laboratory Practices (GLP) requirements and some have no requirements in place currently. Now, there are roughly 13 states that require or recommend accreditation of the testing laboratory to ISO/IEC 17025.

CIJ: If and when cannabis use is accepted federally, how is ISO/IEC 17025 accreditation of testing laboratories beneficial?

Roger: The accreditation process provides a uniform platform to allow for comparability of test results between states. This would also allow for these laboratories to benefit by being able to expand their customer base, if state borders were not an artificially imposed barrier to trade. This could also help to raise the quality of the testing services by allowing for greater participation in realistic accredited proficiency testing programs, which can create greater comparability of methods and results.

CIJ: What are the benefits to the states by choosing to require ISO/IEC 17025 accreditation as a basis for competence of testing laboratories?

Roger: States face the unique challenge, due to the federal illegality of cannabis, that they must craft their own regulatory cannabis program requirements. The ISO/IEC 17025 requirements provides a means upon which to recognize laboratory competence. This saves the states from having to come up with their own laboratory quality management requirements detailing the necessary activities a laboratory must address with respect to documentation, chain of custody, method validation, etc. Because these items are already considered in the standard. ISO/IEC 17025 helps to creates a baseline consistency amongst laboratories between states. And It also helps to provides for the legal defensibility of the test results. If and when cannabis is legalized on a federal level, a uniform 50 state recognition is possible using ISO/IEC 17025 as the basis of recognition. In short accreditation can help to ensure that test results have greater comparability and reliability; It also provides greater trust and confidence in the labels and the stated ingredients.

CIJ: Many of the laboratories are “starting up”, how is A2LA equipped to deal with the influx of novice laboratories in this field of testing?

Roger: A2LA offers many different relevant training classes, including those on the ISO/IEC 17025 standard itself, (as well as ones that also contain cannabis-specific content), internal auditing, documenting your quality system, etc. for the laboratories. A2LA also is knowledgeable regarding various states’ cannabis regulatory requirements and can help guide the labs through some of the many obstacles they face in order to perform testing in their state.

CIJ: Does A2LA provide any technical assistance to laboratories that are starting up in this industry?

Roger: A2LA has numerous technical assessors who are experts in the analytical technology associated with cannabis testing. Assessors can be hired in a consulting role and act independently of the assessment process (and independent of A2LA). As a consultant, they can also assist in setting up a quality management system in compliance with ISO/IEC 17025.

CIJ: What benefits can be gained from a laboratory seeking accreditation or from a state that requires cannabis testing laboratories to be accredited?

Roger: Accreditation can provide legal defensibility and increased confidence in the test results being able to stand up in court. It also may help to lower the cost of doing business because it helps to ensure that the test methods are in control by the laboratory and has been shown to be able to reduce the need for repeat testing. Laboratory accreditation has also led to reduced insurance rates in some cases.