Editor’s Note: This is an article submission from the EAS Consulting Group, LLC team.
To Audit, or not to audit? Not even a question! Audits play a crucial role in verifying and validating business practices, ensuring suppliers are meeting their requirements for Good Manufacturing Practices (GMPs), and most importantly, protecting your interests by ensuring that you consistently receive a compliant and quality product. Audits can help ensure sound business procedures and quality systems, including well-established SOPs, verification and documentation of batch records, appropriate sanitation practices and safe storage and use of ingredients. Audits can also identify deficiencies, putting into motion a corrective action plan to mitigate any further challenges. While a detailed audit scheme is commonplace for established industries such as food, pharmaceuticals and dietary supplements, it is equally important for the cannabis industry to ensure the same quality and safety measures are applied to this budding industry.
If the question then is not whether to audit, perhaps the question is howand when to audit, particularly in the case of a company’s suppliers.This is an opportunity to strengthen the working relationship with each side demonstrating a commitment to the end product.
Supplier audits ensure first and foremost that the company with which you have chosen to work is operating in a manner that meets or exceeds your quality expectations – and you should have expectations because ultimately your product is your responsibility. Any issues that arise, even if they are technically the fault of a supplier, become your issue, meaning any enforcement action taken by your state regulators will directly impact your business. Yes, your supplier may provide you with a batch Certificate of Analysis but you should certify their results as well.
Audits are a snapshot of a moment in time and therefore should be conducted on a regular basis, perhaps biennially or even annually, if they are a critical supplier. In some cases, companies choose to bring in third-party auditors to provide an objective assessment of suppliers. This is especially helpful when the manufacturer or customer does not have the manufacturing, compliance and analytical background to accurately interpret data gathered as part of the audit. With the responsibility for ensuring ingredient identity and product integrity falling on the manufacturer, gaining an unbiased and accurate assessment is imperative to reducing the risk to your business.
Conducting a supplier audit should be well planned in advance to ensure both sides are ready. The audit team must be prepared and able to perform their duties via a combination of education, training and experience. A lead auditor will oversee the team and ultimately will also oversee the results, verifying all nonconformities have been properly identified. They will also work with the supplier to conduct a root cause analysis for those nonconformities and develop a corrective action plan to eliminate them from occurring in the future. The audit lead will also verify follow-up results.
Auditors should discuss with the supplier in advance what areas will be observed, what documentation will need to be ready for review and they should conduct their assessments with professionalism. After all, this is an opportunity to strengthen the working relationship with each side demonstrating a commitment to the end product.This is your chance to ensure your suppliers are performing and will meet your business, quality and product expectations.
Auditors must document that ingredient identity and finished product specifications are verified by test methods appropriate for the intended purpose (such as a whole compound versus a powder). State regulations vary so be certain to understand the number and types of required tests. Once the audit is complete and results are analyzed, you, the manufacturer, have an opportunity to determine if the results are acceptable. Remember, it is your product, so ultimately it is your responsibility to review the available data and release the product to market, you cannot put that responsibility on your supplier.
Quality Agreements as Part of a Business Agreement
There are opportunities to strengthen a partnership at every turn, and one way to set a relationship on the right path is to include a quality agreement as part of a business agreement. A quality agreement lays out your expectations for your suppliers, what you are responsible for and is a living document that, once signed, demonstrates their commitment to upholding the standards you expect. Just as with a business agreement, have any quality agreements reviewed by an outside expert to ensure the wording is sound and that your interests are protected. This is just another step in the development of a well-executed business plan and one that solidifies expectations and provides consequences when those expectations are not met.
Supplier audits must be taken seriously as they are opportunities to protect your brand, your business and your consumers. Enter into an audit as you would with any business endeavor – prepared. This is your chance to ensure your suppliers are performing and will meet your business, quality and product expectations.
Last week, Oregon Secretary of State Dennis Richardson published his office’s audit of The Oregon Liquor Control Commission (OLCC). The audit uncovered a number of inadequacies with the regulatory agency, most notably the problems with their tracking system, designed to prevent cannabis form being sold on the black market.
The report highlights the need for Oregon to implement a more robust tracking system, citing reliance on self-reporting, overall poor data quality and allowing untracked inventory for newly licensed businesses. The audit also found an insufficient number of inspectors and unresolved security issues. According to The Oregonian, the OLCC only has 18 inspectors, roughly one for every 83 licensed businesses.
Auditors also found inadequacies in the application system, saying the OLCC doesn’t monitor third-party service providers and doesn’t have a process in place for reconciling data between the licensing and tracking systems. The audit found there is a risk that decisions made for the program could be based on unreliable data. It also found a risk of unauthorized access to the systems, due to a lack of managing user accounts.
This audit’s publication is very timely. Most notably because U.S. Attorney Billy Williams, who called Oregon’s black market problem “formidable,” convened a summit this week to examine how Oregon can prevent cannabis being exported to other states. According to the Oregonian, Williams said Oregon has an “identifiable and formidable overproduction and diversion problem.” The audit’s findings highlighting security issues are also very timely, given that in the same week, Oregon’s neighbor to the North, Washington, experienced a security breach in its own tracking system.
The problems with the Oregon tracking system’s security features are numerous, the audit says. They found that the OLCC lacks a good security plan, IT assets aren’t tracked well, there are no processes to determine vulnerabilities, servers and workstations not using supported operating systems and a lack of appropriately managing antivirus solutions. “Long-standing information security issues remain unresolved, including insufficient and outdated policies and procedures necessary to safeguard information assets,” reads the report’s summary.
The audit proposes 17 recommendations for the state to bolster its regulatory oversight. Those recommendations intend to address undetected compliance violations, weaknesses in application management, IT security weaknesses and weaknesses in disaster recovery and media backup testing. You can read the full audit here.
Lezli Engelking founded the Foundation of Cannabis Unified Standards (FOCUS) in 2014 to protect public health, consumer safety, and safeguard the environment by promoting integrity in the cannabis industry through the use of standards. Standards are an agreed upon way of doing things and specify guidelines or requirements for producing goods or providing services, according to FOCUS.
Standards can take the form of a “reference document, which may include specifications, guidelines, conditions or requirements for products, operations, services, methods, personnel and systems on how to design, operate, manufacture or manage something.” Peter Maguire, VP of System Applications for Lighthouse Worldwide Solutions and committee chair of the FOCUS Cultivation standard, joined the organization wanting to make a positive impact on the industry that is in line with protecting people and medical patients. He sees so much variability in the industry and the need to homogenize standard operating procedures (SOPs). “I have worked with multiple cultivation facilities and a few of them have operating procedures in place but having them in place is only half the solution- it’s critical to have the right ones in place,” says Maguire. He has twenty years of experience in contamination control in manufacturing, before entering the cannabis industry.
The FOCUS cultivation standard was created by experts who have years of experience in both cannabis cultivation, good agricultural practices and in the tightly regulated pharmaceutical industry. “FOCUS created these guidelines as a sort of roadmap for success in business; You need to keep your employees healthy and your products safe to survive in the long term,” says Maguire. We sit down with Lezli Engelking to find out how the standards are created, what makes them significant and what businesses can gain by working with them.
CannabisIndustryJournal: Why are standards important?
Lezli: Standards are the international language for trade – they exist in every industry. “The U.S. Department of Commerce estimates that standards and conformity assessment impact more than 80% of global commodity trade.” FOCUS is not reinventing the wheel with what we are doing. We are simply adapting a business model the federal government already uses. In the 80s, when the heroin epidemic swept across the US, methadone clinics popped up in every state in the country within two years. The clinics were all operating under different state, city and county regulations – much like the cannabis industry is today. The federal government took a look at the situation and decided they needed a way to regulate these clinics in order to protect public health and safety. They released a Request For Proposal (RFP) looking for an organization to create voluntary-consensus standards and a third-party certification system for the methadone clinics. Commission on Accreditation of Rehabilitation Facilities (CARF) is the organization that answered and won that RFP. CARF continues to work with Health and Human Services to maintain the standards and provide third-party certification to the clinics today. FOCUS develops international, voluntary consensus standards and a third party certification program for the global cannabis industry based on the CARF model. This is extremely important, because of the National Technology Transfer and Advancement Act, (Public Law 104-115), signed into law March 7, 1996 by President Clinton. The act requires that all federal agencies use standards developed by voluntary-consensus standards bodies, instead of government-unique standards wherever possible. Perhaps even more importantly, the Act includes provisions that encourage federal agencies to partner with the private sector in the development of standards that not only help improve the efficiency and effectiveness of government, but also strengthen the U.S. position in the global marketplace.
CIJ: What exactly goes into developing a voluntary-consensus standard?
Lezli: Voluntary-Consensus refers to the type of standard and how it is developed. Everyone who participates in the development of voluntary-consensus standards does so on a voluntary basis. Committee members must come to a consensus on every point within the standard- down to every comma or semicolon. Once the development process is complete, the standards must undergo a 30-day public review period. The process for developing voluntary-consensus standards is designated by International Organization for Standardization (ISO). ISO has member agencies in 163 countries that participate in the development of standards. The American National Standards Institute (ANSI) is the American body for ISO. FOCUS follows all ISO/ANSI guidelines in the standards development process. This is extremely important because it means FOCUS standards are suitable for accreditation and adoption into regulations according to the National Technology Transfer and Advancement Act. All voluntary-consensus standards are developed under the principles of:
Openness| Participation in the standard development process is open to individuals with a stake in the standard who bring useful expertise along with the spirit and willingness to participate.
Balance| Focus stakeholder groups involve all stakeholder groups: industry, regulatory, quality assurance, medical, law enforcement, business, research, consumers, patients and the general public.
Voluntary-Consensus| Individual subcommittees of volunteers develop each area of the standard, offering their unique expertise to form a consensus. They are not paid for their participation.
Lack of Dominance| No party has dominant representation, or influence to the exclusion of fair and equitable consideration of other viewpoints.
CIJ: More specifically, how are the FOCUS standards developed?
Lezli: To create a baseline standard, FOCUS utilized World Health Organization (WHO) guidelines for Good Manufacturing Practices (GMP), Good Agricultural Practices (GAP), Good Laboratory Practices (GLP), Code of Federal Regulations (CFR) for pharmaceutical GMPs, nutraceutical GMPs, food safety standards, OSHA and HACCP. From there, applicable cannabis regulations from around the world were added. All of this information was compiled into auditor-style checklists. Each committee member was provided time to go edit, remove or add to items in the checklist on their own. Over the next two years, each of the eight committees had monthly meetings, going through and coming to a consensus on each line item of the standard. Once the committees completed development, the standards were open for a 30-day Public Review to collect comments and feedback. The first eight FOCUS standards, completed and ready for use, cover Cultivation, Retail, Extraction, Infused Products, Laboratory, Security, Sustainability and Packaging & Labeling.
FOCUS is currently recruiting committee members to begin development of five new cannabis standards later this year: Advertising/Marketing, Insurance, Banking/Finance, Patient Care and Research. Committees will receive a list of proposed suggestions for what should be considered in developing the standards. Each committee member will develop a list to select criteria they think should be included into the standard. FOCUS will compile the lists, then committees will go through the monthly standards development/vetting process for each line item in the standard.
CIJ: So what does a business have to gain by adopting a FOCUS standard?
Lezli: Compliance becomes easily manageable with the FOCUS software platform, integrating standards, training and SOPs into the everyday operations of the business. FOCUS certified clients could expect to reduce costs, reduce risk and reduce liability by assuring they are producing safe, quality and consistent products. FOCUS certification allows a business to differentiate themselves from their competitors, and prove to their patients and customers they can trust their products. Certification also allows businesses to access reasonable insurance rates and drives interest from investors.
FOCUS is here to partner with cannabis businesses. We are there to hold their hand, by providing guidance and assistance along every step of the way. Unlike state mandated audits that delineate what a business is doing right or wrong, FOCUS is an on-going compliance management system. We are here to make sure a business runs as efficiently as possible and take the guesswork out of compliance. Under FOCUS certification, a business receives ongoing consulting, customized SOPs, employee training and a documentation management software system to track and prove compliance.
CIJ: Can you give us an update on FOCUS’ progress in 2016?
Lezli: A large milestone for FOCUS this year, aside from completing version one of the standards, is choosing an appropriate software platform, (Power DMS) to house the standards and provide an ongoing compliance management system for our clients. Power DMS also houses regulatory standards for law enforcement; health care, federal aviation and fire departments, so most agencies in public health are already familiar with it. The familiarity and access to this platform is a huge benefit on the regulatory side. It allows first responders to access the schematics of a FOCUS certified client in the event of an emergency. This is crucial in the event of an explosion from extraction equipment, or a fire in a cultivation facility, as without first identifying where the hazards are, they will not access the facility. The FOCUS software platform allows first responders access to all pertinent information through computers in police cars, ambulances, or fire trucks.
For the industry, the FOCUS software platform is equally as impressive. Not only does the platform house the standards and all SOPs, it is also complete compliance management system. FOCUS certified clients have a simple management tool that houses all training and documentation, assuring all required compliance documentation can be easily accessed at any time. The platform also allows FOCUS certified clients to provide access to governing bodies in advance of state audits –streamlining the process and minimizing time and interruption caused by state audits. The FOCUS platform tracks all changes to required documents, provides real time updates on employee training, creates appropriate traceability logs, and provides updates on regulatory changes, including which SOPs need to be changed to maintain compliance. The platform allows FOCUS to be way more than an auditing company. FOCUS is a partnership in compliance for cannabis companies wanting to maintain good business practices and stay compliant with regulations.
We have about 140 new committee members that will assist existing committees with standards updates and participate in the development of the next set of FOCUS standards for advertising/marketing, banking/finance, research, patient care and insurance. All committees will convene before 2017.
Clean Green Certified is a third-party certification program that incorporates aspects of the USDA’s National Organic Program (NOP), international organic programs and sustainable farming practices. Cannabis is not eligible for USDA organic certification because it is not a federally recognized crop, so Clean Green Certified is the closest certification nationally available. More than 200 cultivators are currently Clean Green Certified in California, Oregon, Washington, Colorado and Nevada.
Chris Van Hook, attorney and founder of Clean Green Certified, started the program in 2004 out of requests from growers to certify their cannabis as organic. Van Hook has decades of experience working in environmental law and USDA organic certifications. “About 95% of the Clean Green Certification is based on the USDA’s NOP,” says Van Hook. “The Clean Green Certified cannabis farmer would be eligible for an organic certification as soon as it becomes available, so we are helping the industry get accustomed to the regulations, inspections, and audits that come with getting organically certified.”
Getting Clean Green Certified requires an initial application. Upon inspection, Van Hook’s program examines all the inputs, including water and energy usage, nutrients, pesticides, and soil, along with inspecting the actual plants for agricultural vitality. “We follow the plants from seed to when it is harvested, checking for clean surfaces and containers, as well as drying, curing, trimming, and processing practices,” says Van Hook. “Just like organic farming, the cultivator needs to be an engaged manager and heavily involved with the plants. Much more monitoring is involved to prevent pest problems from getting out of control without using pesticides.”
The initial screening process takes into consideration traceability and legal compliance, which in cultivation and processing alike is an eligibility requirement. “We use USDA organic standards as guidance for processor facility reviews as well, which include concentrates and edibles manufacturers, breaking it down to labeling, food handling, standard operating procedures, mock recalls, and more,” says Van Hook.
“In a market so used to a lack of oversight, there definitely are some challenges, but we are bringing the necessary agricultural and food handling regulations into the cannabis industry,” adds Van Hook.
The option to grow organically and acquire a third party certification for it can benefit cultivators across the country looking to market their product as environmentally sustainable and pesticide-free.
Cultivators, manufacturers and dispensaries face a variety of ever-changing regulations that vary between states. The cannabis industry is notoriously inconsistent with regulations and as new legislation changes the rules so often, it can be difficult for businesses to keep up and stay compliant.
CannaScore provides a cannabis compliance auditing system that takes an inspector through questions around the operation, flagging areas that are out of compliance with state regulations. CannaScore works in Washington, Oregon and Colorado, and has plans to provide its services in Nevada and Maryland soon.
After co-founding DANK, a dispensary located in Colorado, Kush Bottles Colorado, a marijuana child-safe packaging company, and Denver Consulting Group, license-to-sale consulting company for the marijuana industry, Greg Gamet co-founded CannaScore after finding third party compliance audits to be lengthy, time-consuming and inefficient. The company developed the program and a mobile app within one year and beta-tested it for another six months.
“We are trying to stay in code with city and state regulations, along with the Colorado Marijuana Enforcement Division [MED], who finally has enough money to go out and enforce those laws. CannaScore identifies areas of concern and allows business owners to take corrective actions before problems ensue,” says Gamet.
According to Gamet, some of the biggest areas of concern for business owners involve making sure employees and day-to-day operations follow the extensive rules set forth by state and local governments. “The MED wants to make sure there is no hidden ownership [or] diversion of the product, and that dispensaries are following the rules, especially when it concerns public safety,” he says. “CannaScore can help businesses get a great overview on how they are operating within these rules that are enforced not only by the MED, but local police and fire departments, local health departments, and the Colorado Department of Agriculture.” The program will be available to other qualified consulting services to use through licensing agreements.
The overall score, much like a FICO or Dun and Bradstreet score, rate an individual’s or business’ credit score, which helps business owners, banks, landlords and other stakeholders know what level of compliancy a cannabis business is operating. It also keeps a compliancy record on hand if a business is required to prove to a governing body its willingness to follow the rules.
In performing dispensary, grow, infused products, and MIP kitchen audits, CannaScore can give the consulting company that is performing the audit the ability to assist in the correction of any and all violations. “Once a violation has been found, the consulting company can work with the customer to get it corrected immediately, which will increase revenues,” says Gamet.
“Because rules and regulations change so often it can be very difficult to stay on top of managing everything that goes into staying compliant,” Gamet adds. “Keeping compliant in the cannabis industry is a full time job and CannaScore can make it easy.”
As the industry grows and regulators hammer out details in legislation, compliance will remain an important part of any cannabis business. Staying in code with local laws and state regulations can make or break a business.