Food safety incidents can be prevented. However, prevention requires planning, which requires the effort of everyone in a company to create a culture of quality and food safety. How exactly do you plan for food safety? Food safety planning implies the building of a food safety management system. Food safety management systems allow for an efficient management of hazards that may be present in the food by the development and implementation of pre-requisite programs (PRPs) and a food safety plan, while supported by management commitment. So, let’s take a closer look at each of these building blocks:Radojka Barycki will lead a plenary session titled, “Cannabis: A Compliance Revolution” at the 2018 Food Safety Consortium | Learn More
The development and implementation of a food safety management system requires financial, equipment, and technically sound personnel in order to be successful and sustainable. The management team of any cannabis product manufacturer must be committed to food safety, so the needed resources to develop and implement a food safety management system are provided. Management commitment creates a culture within the operation that supports, sustains and continuously improves food safety.
Pre-Requisite Programs (PRPs)
Pre-requisite programs are procedures that establish the minimal operations conditions to produce safe and quality products. Pre-requisite programs are the foundation of food safety and must be developed and implemented prior to creating a food safety plan. They keep potential hazards from becoming serious enough to adversely impact the safety of products produced. Pre-requisite programs include but are not limited to:
Supplier Verification Programs
Raw Material Receiving (ingredients, processing aids and packaging)
Good Manufacturing Practices (GMPs)
Preventative Maintenance (PM) Program
Integrated Pest Management (IPM)
Environmental Monitoring Programs (EMPs)
Water Management Programs (WMPs)
Allergen Management Program
Standard Sanitation Operating Procedures (SSOPs)
Standard Operating Procedures (SOPs)
Storage and Transportation Procedures
Food Safety Plan (FSP)As you can see, food safety planning requires the development and implementation of a lot of programs.
A food safety plan is a documented systematic approach that follows the Codex Alimentarius HACCP Principles to identify, prevent and minimize to an acceptable level or control hazards that may be present in food and that can cause an illness or injure the consumer. The first step in this systematic approach is the formation of a food safety team, which main responsibility is to identify the scope of the food safety plan and to oversee all of the activities associated with the plan (e.g. monitoring, verification, validation, etc.) After the food safety team is formed, the steps outlined below are followed in order (systematically):
Product Intended Use
Development of the flow diagram
Verification of the flow diagram
Conduct a Hazard Analysis
Identify Critical Control Points (CCPs) or Preventive Controls
Establish Critical Limits
Monitor Critical Limits
Establish Corrective Actions
Establish Verification Procedures
Establish Record Keeping Procedures
As you can see, food safety planning requires the development and implementation of a lot of programs. Therefore, I highly recommend that you hire a food safety consultant that can guide you through this process.
LabVantage Solutions, known in other testing industries as a leader in laboratory information management systems (LIMS), has launched their own cannabis-specific LIMS. Unveiled at the Cannabis Science Conference in Portland, OR, the purpose-built software is designed specifically for cannabis testing and certification.
Here are a few key highlights of their system, taken from the press release:
Available through perpetual licensing or SaaS
One platform for all tests, instruments, sample information, and results data, with option to embed ELN, LES, and other modules
Registers sample requests, including a portal for remote requests from growers and distributors
Fully audited sample lifecycle and audit trail
Certificates of Analysis customized for local regulatory requirements
Includes American Herbal Pharmacopoeia® tests for Cannabis Inforescense.
LabVantage says their system can support ISO/IEC 17025 compliance, ISO 9001:2015, 21 CFR Part 11 and Annex 11 and GLPs as well. According to Bob Voelkner, vice president of sales and marketing, it has a very open architecture as well as web services technology, which allows for integration with METRC and other traceability software platforms. “We know the testing methodologies these labs use, so the customer doesn’t have to create that from scratch,” says Voelkner. “This is meant to be out of the box and ready-to-use, so the customer can get up and running with minimal lag time.” LabVantage has actually been a provider of LIMS solutions for over 30 years and they serve a broad range of lab types.
Voelkner says they’ve been working with clients at cannabis labs over the past few years to configure their LIMS for this space specifically. “The lab managers can modify workflows on their own without having to write code,” says Voelkner. “We have a well-established solution with a good track record, that’s been around for a while and is proven. Some other players that are brand new to the space may be new to LIMS and that may not be a good thing. We are a market leader in the global LIMS space with a proven product that is very well established and very powerful.” Voelkner adds that lab managers get to own their data, not LabVantage. “You own the data. It is your database and it is proprietary to you. It is yours to use as you see fit.”
Lab managers have the option to configure the system to adapt to new compliance issues themselves, or work with the LabVantage professional services team to build it out further. “This particular space is new and emerging, it is pretty dynamic — we see a lot of change happening,” says Voelkner. “We believe this space needs a highly flexible platform and this is a proven technology solution with a lot of configurability built into it.”
Documents play a key role in the world of regulations and global standards. Documents tell a story on programs development, implementation and verification during an inspection or audit. Documents are used as evidence to determine conformance to the law or standard. However, do you know what kind of documents may be reviewed during a regulatory inspection or a food safety audit? Are you prepared to show that the implementation of regulatory requirements or a standard is done efficiently at your facility?
Inspectors and auditors will look for compliance either to regulations or to a standard criterion. Regulations and standards require that documentation is controlled, secured and stored in an area where they cannot deteriorate. Therefore, writing a Document Management Program (DMP) will help a business owner ensure consistency in meeting this and other requirements.Radojka Barycki will host a a plenary session titled, “Cannabis: A Compliance Revolution” at the 2018 Food Safety Consortium | Learn More
A well-developed and implemented DMP provides control over documents by providing a number sequence and revision status to the document. In addition, ownership for development, review and distribution of the documents are assigned to specific individuals within the company to ensure that there are no inconsistencies in the program. Documents must also have the name of the company in addition to a space to write the date when the record is generated. It is recommended to include the address if there are multiple operational sites within the same company.
There are different types of documents that serve as support to the operations:
Program: A written document indicating how a business will execute its activities. When it comes to the food industry, this is a written document that indicates how quality, food safety and business activities are controlled.
Procedures: General actions conducted in a certain order. Standard Operational Procedures (SOPs) allow the employee to know what to do in general. For example, a truck receiving procedure only tells the employee what the expected conditions are when receiving a truck (cleanliness, temperature, etc.) However, it doesn’t tell the employee how to look for the expected conditions at the time of the truck arrival.
Work Instructions: Detailed actions conducted in a certain order. For example, truck inspection work instruction tells the employee what steps are to be followed to perform the inspection.
Forms: Documents used to record activities being performed.
Work Aids: are documents that provide additional information that is important to perform the job and can be used as a quick reference when performing the required activities within the job.
The inspectors and auditors base their role on the following saying: “Say what you do. Do what you say. Prove it!” The programs say what the company do. The procedures, work instructions and work aids provide information on implementation (Do what you say) and the forms become records that are evidence (prove) that the company is following their own written processes.
Regulatory requirements for cannabis vary from state to state. In general, an inspector may ask a cannabis business to provide the following documentation during an inspection:
Product Traceability Programs and Documents
Product Testing (Certificate of Analysis – COAs)
Certification Documents (applicable mainly to cannabis testing labs)
Proof of Destruction (if product needs to be destroyed due to non-compliance)
Training Documents (competency evidence)
As different states legalize cannabis, new regulatory requirements are being developed and modeled after the pharma, agriculture and food industries. In addition, standards will be in place that will provide more consistency to industry practices at a global level. The pharma, agriculture and food industries base their operations and product safety in programs such as cGMPs, GAPs, HACCP-based Food Safety Management Systems and Quality Management Systems. Documents required during an inspection or audit are related to:
Good Agricultural Practices (GAPs)
Current Good Manufacturing Practices (cGMPs)
Food Safety Plan Documents
Ingredient and Processing Aids Receiving
Ingredient and Processing Aids Storage
Operational Programs (Product Processing)
Final Product Storage
Final Product Transportation
Document Management Program
In the always evolving cannabis industry, are you prepared to face document requirements now and in the future?
Now that governments are legalizing cannabis around the world, the question looms for cannabis businesses seeking legitimacy in the new industry: what safety standards should apply? This question is more difficult as different jurisdictions grapple with defining and implementing legal requirements and struggle to keep up with the pace of growth.
For visionary cannabis business, it makes sense to anticipate requirements – not only from governments, but also from consumers and partners. Most regulations currently focus on security and basic health issues but, in the long-term, the industry that may offer the best model for cannabis businesses isn’t pharmaceuticals, but food. Cannabis (especially edibles) share similar hazards and traceability challenges with food products, so taking the lead from the food industry will be much more applicable and could offer greater benefits.
Companies that achieve the highest and most flexible certification will enjoy a crucial competitive advantage when it comes to winning market share, popularity and consumer trust. Let’s take a quick look at the different options of food safety (and quality) certifications that cannabis businesses may consider. But first, let’s clarify two important definitions that are necessary to understand the food industry.
Basic Concepts from the Food Industry
The first acronym you should be aware of is GFSI, the Global Food Safety Initiative. GFSI is a food industry-driven global collaboration body created to advance food safety. When it comes to understanding GFSI, the important part to note is that certifications recognized by GFSI (like SQF, FSSC 22000, and BRC) are universally accepted. Companies operating under GFSI-recognized certifications open the most doors to the most markets, providing the highest potential for growth. For this reason, cannabis companies should be aware of and seriously consider seeking GFSI certifications
Secondly, many food safety programs are built around Hazard Analysis Critical Control Points, or HACCP. While many people may talk about HACCP like it’s a certification in and of itself, it is not actually a certification like the others on this list, but rather a methodology that helps companies systematically identify and control biological, chemical, and physical hazards that may arise during food production, handling, and distribution. Companies that adopt this methodology end up with a HACCP plan, which must then be followed at all times to avoid and address health and safety issues. It’s often required for food businesses and is generally required in most of the world, except where ISO 22000 is more common, primarily in Europe and countries whose primary export market is European. Since HACCP plans are also incorporated into most of the other achievable certifications, developing a HACCP program early will build a strong foundation for higher levels of certification.
Certifications for the Cannabis Industry
Now that we understand the basics of GFSI and HACCP, we can see how the certifications that have been developed by and for the food industry may apply to cannabis companies – and which you should consider necessary for your business.
GMP: Good Manufacturing Practice Certification
GMP (or sometimes cGMP) certification requires that companies abide by a set of good manufacturing processes for food and beverage products, pharmaceuticals, cosmetics, dietary supplements and medical devices. Since it really only covers basic sanitation and employee hygiene, it is considered the lowest level of certification in the industry. It is not recognized by GFSI, but GFSI does require all the standard benchmarks of a GMP be met before granting GFSI certification.
While GMP certification is often required, it is far below the standard that should be upheld by any serious businesses. It doesn’t cover many of the different types of hazards associated with food production – that I have argued will become increasingly relevant to cannabis producers – and doesn’t provide a systematic approach to identifying and controlling hazards like a HACCP program would. It’s really just about providing the basic procedures and checks to ensure that the facility is clean and that employees aren’t contaminating the products.
Final Verdict: Recommended, but as the bare minimum. GMP is not sufficient on its own to adequately control the risk of recalls and foodborne illness outbreaks, and it limits a company’s market potential because it lacks the GFSI worldwide stamp of approval.
Some companies consider GMP certification a good place to start if you’re on a tight deadline for distribution in markets where only GMP is required by regulators. I would argue that striving for the minimum standards will be costly in the long run. Health, safety and quality standards are the foundations upon which winning companies are built. It’s critical to develop a corporate culture that will lead to GFSI-recognized programs without major organizational overhaul. Start on the right foot and set your sights higher – obtain a certification that will stand the test of time and avoid the pain and risks of trying to change entrenched behaviors.
SQF: Safe Quality Food Program Certification
SQF is my number one recommendation as the best certification for the cannabis industry. One of the most common certifications in North America, SQF is a food safety management system recognized by retailers and consumers alike. It is administered by the Food Marketing Institute (FMI) and, importantly, recognized by GFSI, which gives companies a huge competitive edge. SQF focuses on the whole supply chain.
SQF was also the first to develop a cannabis program and is currently the leader in this market segment. It is also the scheme that best integrates food safety with quality. Since it is recognized worldwide, SQF provides the greatest leverage to accelerate a company’s growth. Once obtained, products with SQF certification can often jump the queue to enter different regulatory markets.
Final verdict: Highly recommended. A cannabis company with an SQF certification has the greatest advantage because it offers the broadest worldwide reach and keeps companies a step ahead of competitors. It’s also achievable – just this past April, Curaleaf Florida ostensibly became the first cannabis company to achieve SQF certification. It is tough, but fair and practical.
Other Certification Standards
SQF is the top certification that should be considered by cannabis companies, especially outside of Europe. However, the food industry has several other major types of standards that, at this time, have limited relevance to the cannabis industry today. Let’s take a quick look.
When considering GFSI-recognized programs, the main choice for food companies is between SQF, which we’ve covered, and BRC (the British Retail Consortium Certification). BRC has the most in common with SQF but, while SQF was originally developed for processed foods, BRC was developed in the UK for meat products. Today, they are quite similar, but BRC doesn’t focus quite as much on the quality component as SQF does. While BRC could be a good option, they don’t have a program for cannabis and, thus far, do not appear to be as friendly toward the cannabis industry.The food industry has a lot to offer cannabis companies that are anticipating future regulatory changes and market advantages
Across the pond, there are a few other certification standards that are more common than SQF. One of these is ISO 22000, which is the certification for the food-related standard created by the International Organization for Standardization (ISO) in Europe. It is not recognized by GFSI but is the primary system used in Europe. If your market is exclusively in the EU, it might be a good choice for you in the future. However, to date, there is no indication that any cannabis company has achieved ISO 22000 certification. Some cannabis companies have attained certification for other ISO standards like ISO 9001:2015, which specifies requirements for quality control systems, and ISO/IEC 17025 for laboratory testing. These are generally more relevant for the pharmaceutical industry than food and beverage, but still apply to cannabis.
There is the perception that cannabis is more accepted in EU countries like the Netherlands, but the regulatory attitude to cannabis is complicated. In the Netherlands, for example, cannabis isn’t actually legal – “coffee shops” fall under a toleration policy that doesn’t include regulation. Medical cannabis in the Netherlands is all produced by one supplier and several countries in the EU allow for licensed distribution and import, but not domestic production. Various EU countries are trying to keep up with the legalization trend, however. The Czech Republic, Germany, and others all recently introduced legislation for domestic production of cannabis for medical use. For companies with their eye on the EU, it is crucial to watch which regulatory requirements will be implemented in each market and how.
The last certification standard to mention is the result of a compromise between ISO and the more HACCP oriented programs like SQF. FSSC 22000 (Food Safety System Certification) tries to address the gaps between ISO 22000 and GFSI-recognized certifications by introducing another component called PAS 220. Since it is recognized by GFSI, FSSC 22000 is starting to get more traction in the food industry because it makes products a bit easier to export to the EU. FSSC 22000 satisfies the EU ISO standards but isn’t as closely tied to HACCP. We will be keeping an eye on this one.
The food industry has a lot to offer cannabis companies that are anticipating future regulatory changes and market advantages – but it’s difficult for cannabis companies to understand all the options available and how each apply to their specific products. While markets adjust beyond the preliminary issue of legality, it’s crucial for companies to look forward and comply with safety and quality standards like SQF. Companies who strive for SQF certification (or other GFSI-recognized certifications as they become available) will find themselves far better prepared to seize market share as cannabis markets blossom.
With the cannabis industry growing rapidly, laboratories are adapting to the new market demand for medical cannabis testing in accordance to ISO/IEC 17025. Third-party accreditation bodies, such as Perry Johnson Laboratory Accreditation, Inc. (PJLA), conduct these assessments to determine that laboratories are following relevant medical cannabis testing standard protocols in order to detect potency and contaminant levels in cannabis. Additionally, laboratories are required to implement and maintain a quality management system throughout their facility. Obtaining accreditation is a challenge for laboratories initially going through the process. There are many requirements outlined in the standard that laboratories must adhere to in order to obtain a final certificate of accreditation. Laboratories should evaluate the ISO 17025 standard thoroughly, receive adequate training, implement the standard within their facility and conduct an internal audit in order to prepare for a third-party assessment. Being prepared will ultimately reduce the number of findings detected during the on-site assessment. Listed below is research and evidence gathered by PJLA to determine the top ten findings by clause specifically in relation to cannabis testing laboratories.
4.2: Management System
Defined roles and responsibilities of management system and its quality policies, including a structured outline of supporting procedures, requirements of the policy statement and establishment of objectives.
Providing evidence of establishing the development, implementation and maintenance of the management system appropriate to the scope of activities and the continuous improvement of its effectiveness.
Ensuring the integrity of the management system during planned and implemented changes.
Communication from management of the importance of meeting customer, statutory and regulatory requirements
4.3: Document Control
Establishing and maintaining procedures to control all documents that form the management system.
The review of document approvals, issuance and changes.
4.6: Purchasing Services and Supplies
Policies and procedures for the selection and purchasing of services and supplies, inspection and verification of services and supplies
Review and approval of purchasing documents containing data describing the services and supplies ordered
Maintaining records for the evaluation of suppliers of critical consumables, supplies and services, which affect the quality of laboratory outputs.
4.13: Control of Records
Establishing and maintaining procedures for identification, collection, indexing, access, filing, storage and disposal of quality and technical records.
Providing procedures to protect and back-up records stored electronically and to prevent unauthorized access.
4.14: Internal Audits
Having a predetermined schedule and procedure for conducting internal audits of its activities and that addresses all elements that verify its compliance of its established management system and ISO/IEC 17025
Completing and recording corrective actions arising from internal audits in a timely manner, follow-up activities of implementation and verification of effectiveness of corrective actions taken.
Laboratory management not ensuring the competence and qualifications of all personnel who operate specific equipment, perform tests, evaluate test results and sign test reports. Lack of personnel undergoing training and providing appropriate supervision
Providing a training program policies and procedures for an effective training program that is appropriate; identification and review of training needs and the program’s effectiveness to demonstrate competence.
Lack of maintaining records of training actions taken, current job descriptions for managerial, technical and key support personnel involved in testing
5.4: Test and Calibration Methods and Method Validation
Utilization of appropriate laboratory methods and procedures for all testing within the labs scope; including sampling, handling, transport, storage and preparation of items being tested, and where appropriate, a procedure for an estimation of the measurement of uncertainty and statistical techniques for analysis
Up-to-date instructions on the use and operation of all relevant equipment, and on the handling and preparation of items for testing
Introduction laboratory-developed and non-standard methods and developing procedures prior to implementation.
Validating non-standard methods in accordance with the standard
Not completing appropriate checks in a systematic manner for calculations and data transfers
5.6: Measurement Traceability
Ensuring that equipment used has the associated measurement uncertainty needed for traceability of measurements to SI units or certified reference materials and completing intermediate checks needed according to a defined procedure and schedules.
Not having procedures for safe handling, transport, storage and use of reference standards and materials that prevent contamination or deterioration of its integrity.
5.10: Reporting the Results
Test reports not meeting the standard requirements, statements of compliance with accounting for uncertainty, not providing evidence for measurement traceability, inaccurately amending reports.
SOP-3: Use of the Logo
Inappropriate use of PJLA’s logo on the laboratories test reports and/or website.
Using the incorrect logo for the testing laboratory or using the logo without prior approval from PJLA.
The stage is set: cannabis legalization is rolling out around the world. With legalization comes regulations and smart companies will adapt to make new requirements work for them. In the end, our shared goal (as industry, consumers and government) is the same: provide safe, high-quality, reliable products. This is where traceability comes in.
If a cannabis product isn’t safe (cannabis is vulnerable to the same kinds of hazards as most food products), the reputation of the entire industry suffers. Earning public trust is the first step toward favorable government regulations. With upcoming decisions that will decide taxation and distribution, it’s more important than ever that cannabis producers can react quickly if recalls should occur – and that means taking traceability seriously.
Comprehensive Traceability for Cannabis Means More Than Legality
A crucial key to producing safe and high-quality cannabis products is detailed traceability. Many states require cannabis businesses to use systems like Metrc, a technology that uses RFID tags to track cannabis from seed to sale to ensure nothing is diverted to the black market. However, Metrc focuses only on the chain of custody, not on the safety or quality of the product.
Ensuring a secure supply chain is only one piece of the cannabis puzzle. Public health hazards like toxic chemical contamination, mold growth and pathogenic contamination introduced by pests or improper employee handling need to be controlled in order to earn public trust and comply with regulations. State-mandated traceability systems don’t address these imperatives, so an effective safety technology that includes traceability, in addition to mandated systems like Metrc, is absolutely necessary to complete the cannabis picture.
Automation Technology Supports Cannabis Companies’ Growth and Helps With Audits
Cannabis professionals are aware of the regulatory scrutiny the industry is under and many have turned to automation technology to help stand up to this scrutiny, as well as collect and manage all the data necessary for compliance. Automating data collection pays off in several ways. For one, interconnected, real-time IoT technologies that are accessible to the entire facility 24/7 are giving cannabis businesses the tools they need to create the best possible products now, as well as providing them with the data they need to make their products even better. Since frequent audits are a part of the legalization transition, automation also makes preparing for audits and inspections a matter of minutes instead of days.
Ron Sigman, chief executive officer of marijuana compliance consulting firm Adherence Corp. and former investigator for the Marijuana Enforcement Division (MED) in Colorado, lists the most common violations for cannabis businesses that he found during more than 200 audits in an interview for Marijuana Business Daily. These violations include:
Metrc issues, especially accounting not matching inventory (too many plants or ounces of marijuana on the premises);
Security issues like lack of sufficient camera coverage;
Failure to upgrade licenses;
Improper or incomplete training of new employees.
Adopting safety and traceability concepts that the food industry developed over many decades can yield huge benefits for cannabis businessesA proper cannabis traceability technology mitigates these problems by providing notifications of inventory inconsistencies, certification expirations and more. Traceability for cannabis must be able to handle the complexities of procedures like terpene extraction and injection. With the rapid growth of the industry, it must be able to set targets and track actuals. It should track, not just cannabis plants and related derivatives, but also every other ingredient, material and packaging material used during production. There must be monitoring at each stage of production and a system in place to ensure all employee training is up to date. Preventative maintenance must be scheduled and tracked and hazards must be identified and controlled. In the event of an audit or recall, precise mass-balance calculations must be available to account for every gram of product, including non-cannabis ingredients like coconut oil and packaging materials like pouches and labels.
Detailed traceability can make the difference between a cannabis business keeping their license or being shut down. “You have to make a diligent effort to stay compliant 365 days out of the year, because you never know when a regulatory agency is going to come knocking on your door,” says Sigman. Knowing exactly what went wrong when and where allows a company to make changes so failures don’t happen again.
Higher Standards Will Be Demanded
The standard sought by most in the cannabis industry is only GMP (Good Manufacturing Practice) certification, which is actually the lowest level of certification possible in food production. With the public demand for edibles and concentrates on the rise and major retailers scrambling for seats at the table, the demand for transparency from growers and manufacturers will increase. Cannabis companies will soon find that GMP compliance simply won’t be enough to earn trust and expand their market share, especially when it comes to edibles and concentrates.
“Every day, patients express interest and assurance of wanting to know that the foods and medicines they consume are safe and of the best quality available,” says Lindsay Jones, president of Curaleaf Florida, the first medical cannabis company in Florida to achieve SQF Certification. Safe Quality Food (SQF) certification ensures a company meets the highest levels of safety and quality on a reliable basis. Curaleaf has set a new bar in the industry that others will be compelled to follow and they should be congratulated for their proactive vision.
Adopting safety and traceability concepts that the food industry developed over many decades can yield huge benefits for cannabis businesses, but it will be interesting to watch the technology evolve to accommodate the specific needs of retailers and consumers. Imagine a traceability system that ensures safety and quality while also tracking consistency and potency.
The Future of Cannabis Is Bright
The emerging cannabis industry is facing challenging hurdles on its path to widespread legalization and acceptance but the forecast is sunny – for companies who are prepared.
Earlier this week Capitol Analysis Group, a cannabis-testing laboratory based in Lacey, Washington, announced they are conducting a “data-driven Lab Transparency Project, an effort to improve accuracy of cannabis testing results in the state through transparency and a new third-party auditing process,” according to a press release. They plan to look through the state’s traceability data to find patterns of deviations and possible foul play.
The project launch comes after Straightline Analytics, a Washington cannabis industry data company, released a report indicating they found rampant laboratory shopping to be present in the state. Lab shopping is a less-than-ethical business practice where cannabis producers look for the lab that will give them the most favorable results, particularly with respect to higher potency figures and lower contamination fail rates.“Lab shopping shouldn’t exist, because it is a symptom of lab variability,”
According to the press release, their report “shows that businesses that pay for the highest number of lab tests achieve, on average, reported potency levels 2.71% higher than do those that pay for the lowest number of lab tests.” They also found labs that provide higher potency figures tend to have the largest market share.
The goal of The Lab Transparency Project is to provide summaries of lab data across the state, shining a light in particular on which labs provide the highest potency results. “Lab shopping shouldn’t exist, because it is a symptom of lab variability,” says Jeff Doughty, president of Capitol Analysis. “We already have standards that should prevent variations in lab results and proficiency testing that shows that the labs are capable of doing the testing.” The other piece to this project is independent third party auditing, where they hope other labs will collaborate in the name of transparency and honesty. “Problems arise when the auditors aren’t looking,” says Doughty. “Therefore, we’re creating the Lab Transparency Project to contribute to honesty and transparency in the testing industry.”
Dr. Jim McRae, founder of Straightline Analytics, and the author of that inflammatory report, has been a vocal critic of the Washington cannabis testing industry for years now. “I applaud Capitol Analysis for committing to this effort,” says McRae. “With the state’s new traceability system up and running following a 4-month breakdown, the time for openness and transparency is now.” Dr. McRae will be contributing to the summaries of lab data as part of the project.
According to Doughty, the project is designed to be a largely collaborative effort with other labs, dedicated to improving lab standards and transparency in the industry.
On February 8th, Peter Antolin, the deputy director for the Washington State Liquor and Cannabis Board (WSLCB), sent an email to licensees explaining why the transition to their new traceability system was disrupted. Last Saturday, someone gained access to the sensitive information in Leaf Data Systems, the state’s traceability software that is powered by MJ Freeway.
“A computer vulnerability was exploited on Saturday, allowing unauthorized access to the traceability system,” Antolin told licensees in the email. “There are indications an intruder downloaded a copy of the traceability database and took action that caused issues with inventory transfers for some users. We believe this was the root cause of the transfer/manifest issue experienced between Saturday and Monday.”
The email goes on to say that no personally identifiable information was available to the ‘intruder,’ but some sensitive information was clearly accessed. That data includes route information of manifests filed between February 1st and 4th as well as transporter vehicle information including VIN, license plate number and vehicle type, according to the email.
That email leaves much to be desired. For one, they do not exactly have a solution, instead trying to alleviate licensees’ worries with a hollow inanity full of meaningless jargon: “The WSLCB and MJ Freeway continue to implement several strategies to prevent future vulnerabilities to future intrusions,” reads the email. “This includes full logging and monitoring and working with third-party entities. Since this remains an active investigation, details on security are not publicly available.” However, today the WSLCB is hosting a webinar where Peter Antolin, their IT division, the MJ Examiners unit and enforcement will be available to answer questions, according to the email.
This is by no means the first security breach that Washington and MJ Freeway have suffered. In May of 2017, Washington originally selected Franwell’s METRC as the contract partner for their traceability software system. Less than a month later in June of 2017, after a mistake in the selection process, Washington selected MJ Freeway instead of Franwell for the traceability contract. Three days later, MJ Freeway’s source code was stolen and published online. Then in September, Nevada cancelled their contract with MJ Freeway after a security breach, their services crashed in Pennsylvania and Spain, and in October it became clear that the company could not meet the October 31 deadline for their new Washington contract.
In November of 2017, BioTrackTHC, the company that held the previous contract for Washington’s traceability software, helped the state through the transition period with a temporary Band-Aid solution to hold the state over until January of 2018. A month after they expected to implement the new MJ Freeway system, the latest security breach occurred this week and disrupting the rollout yet again.
At the end of the email Antolin sent to licensees yesterday, he says there will continue to be attempts to breach the system’s security. “The bottom line is that this incident is unfortunate,” says Antolin. “There will continue to be malicious cyberattacks on the system. This is true of any public or private system and is especially true of the traceability system.” This begs a few questions: why aren’t we hearing about this kind of security breach in other states’ traceability systems? What are other companies doing that prevents this from happening? Why does this keep happening to MJ Freeway?
California’s full legal cannabis market officially opened its doors for business on January 1st, 2018. Following a relatively short time frame when they announced the first licenses awarded less than a month ago, retail stores were open for business in counties throughout California. Customers came out in full force, with long lines on the opening day, with some hundreds deep stretching around blocks.
For the quick turn around time between implementing regulations and awarding temporary licenses, the grand opening of the cannabis market in the nation’s most populous state proceeded smoothly. Only a handful of minor hiccups associated with the launch were reported throughout the state. In the grand scheme of things, that’s a pretty good job for a new regulatory agency (The Bureau) tasked with regulating such a massive fledgling market.
One major and definitely foreseeable hiccup in the launch of California’s new medical and adult use markets was the failure to implement tracking software. According to Michael Blood with The Associated Press, licensed businesses are being asked by the California Department of Food and Agriculture to manually document sales and transfers of cannabis with paper invoices.
While the Department said the traceability system was implemented Tuesday, Blood says, cannabis businesses are not required to use it and will be trained on how to operate it before it becomes required to use later in 2018.
Local control regulations in California means that businesses must first seek approval from local authorities before attaining a temporary license from the state to operate. That coupled with the rolling process of awarding licenses meant that only some cannabis businesses could officially open their doors. Municipalities throughout California handle regulating cannabis differently.
According to a press release published this morning, BioTrackTHC successfully implemented their Universal Cannabis System (UCS) in Washington State, a temporary solution for the state’s seed-to-sale cannabis tracking system, while the new system is yet to be deployed.
BioTrackTHC had a contract with Washington State for four years, which expired just weeks ago at the beginning of November. Back in June, after a few minor hiccups, the state announced that MJ Freeway would be the successive software platform used for the state’s seed-to-sale traceability system.
The deadline for the new software to be ready for deployment was set for November 1st, when the BioTrackTHC contract would expire and the MJ Freeway contract would begin. Between when the contract was awarded and the deadline for implementation, MJ Freeway made headlines for a series of security hacks and systems failures. Subsequently, MJ Freeway said they could not deliver the software platform until January of 2018, leaving a two-month gap where businesses have no state-mandated software to use for the tracking system.
The contingency plan that the state laid out consisted of business owners manually inputting data in excel spreadsheets. When first pressed for a Band-Aid solution, representatives of BioTrackTHC cited security concerns related to MJ Freeway’s hacks as reason for being hesitant to extend their contract through the interim period.
In an open letter to the Washington cannabis industry back in October before the end of their contract, Patrick Vo, president and chief executive officer of BioTrackTHC, laid out an explanation for what went wrong and provided an alternative solution, essentially a private sector version of their government-mandated traceability software system.
Announced this morning, the new system, UCS, is being used by over 1,600 of the 1,700 cannabis licensees in Washington. The UCS has so far submitted 39,000 individual excel spreadsheets to the Washington State Liquor and Cannabis Board (WSLCB). “After the WSLCB announced that their replacement system would not be ready in time and that the only other option was for all 1,700 licensees to submit their seed-to-sale data via manual spreadsheets, BioTrackTHC created the UCS—a privatized clone of the government system—within a few days and deployed it minutes after the termination of the old system to minimize the impact on all licensees,” reads the press release.
The UCS allows business owners to streamline data recording, instead of manually entering information into spreadsheets. It is also integrating with 3rd party software competitors such as WeedTraQR, GrowFlow, Mr. Kraken, TraceWeed, GreenBits, S2Solutions and DopePlow. “After the WSLCB’s announcement, we knew that we had only a few days to provide a universal system to which the whole industry could submit compliance data and enable communication across the supply chain between licensees and their seed-to-sale system,” says Vo. “Our priority was to ensure that licensees could continue to operate in the absence of a government seed-to-sale system. Not having that system in place could have left Washington licensees vulnerable to noncompliance in a variety of ways, not to mention the potentially crippling volume of extra work needed to manually track a business’ entire inventory.”
Washington State’s new traceability software system by MJ Freeway is expected to deploy in January of 2018.
You can adjust all of your cookie settings by navigating the tabs on the left hand side.
Strictly Necessary Cookies
Strictly Necessary Cookie should be enabled at all times so that we can save your preferences for cookie settings.
We use tracking pixels that set your arrival time at our website, this is used as part of our anti-spam and security measures. Disabling this tracking pixel would disable some of our security measures, and is therefore considered necessary for the safe operation of the website. This tracking pixel is cleared from your system when you delete files in your history.
If you disable this cookie, we will not be able to save your preferences. This means that every time you visit this website you will need to enable or disable cookies again.