Maintaining Compliance and Quality Systems in the Cannabis Lab
If we consider compliance an intentional mindset of the business’s corporate culture, then it certainly makes sense that maintaining compliance is more a journey than a destination. Being compliant yesterday does not guarantee continued compliance tomorrow. Compliance is an every-day activity under the umbrella of the quality management system, which instructs practices and procedures and continually records the outcomes of carrying them out.
But, in a more definitive sense, compliance is described by the Society of Corporate Compliance and Ethics (SCCE1) as conducting business and oneself in an ethical, moral, and legal manner. A compliance mindset is essential throughout every sector of the legal cannabis industry, from cultivators and processors, to supply chain distributors, public health safety testing, and ultimately the dispensary for point-of-sale to the consumer.
Compliant and reliant
Transfers between licensees are tracked by seed-to-sale cannabis tracking systems (CTSs), such as METRC2 or MJ Platform3, to facilitate reconciliation for each licensee and tracking for all licensees at the state level. Laboratories testing cannabis for state regulatory purposes are unique within the supply chain – many producer licensees transfer small amounts of product to the lab licensee for testing, constituting a compliance feedback loop to screen the product for potency, chemical impurities, and other public health concerns (E. coli, salmonella, and mold are examples).
As a result, laboratories testing cannabis track and report on inventories of relatively small amounts of cannabis and infused products, while meeting post-analysis hold time regulations defined by each state (45 business days is typical). When the suite of tests is complete and the lab issues the product certificate of analysis, or CoA, those results are posted to both the client and the state CTS. A passing result releases the associated batch of product for sale (or transfer to another licensee). A failed result initiates either a remediation pathway or destruction pathway for the associated product batch.
A fundamental theme in any commercial laboratory is maintaining compliance with state and federal regulations, safety specifications, hazardous waste handling management, and methodology requirements according to the lab’s scope of testing, governing standard and accreditation body oversight. Additional compliance considerations in the cannabis testing space include reporting to the state-specific seed-to-sale tracking systems, age restrictions for employees handling product, tracking of destroyed samples upon expiration of hold time, and video monitoring of all activity on the licensed premises.
Ensuring a lab can establish and maintain adequate procedures to carry out the work it offers is a function of the resident talent, including a lab director, quality manager, and team of employees dedicated to data integrity and the overall success of the lab. Beyond simply reporting results, the lab must verify proper training of staff, record and report deviations to standard operating procedures (SOPs), and implement corrective actions to rectify processes in response to errors.
As defined by the state
The nitty-gritty of maintaining laboratory compliance with regards to the data produced is most easily understood in the context of the recognized standard the laboratory must meet, with oversight by an accreditation body authorized to audit labs to the standard.
For example, in California and many other states, labs that test cannabis must be accredited to ISO 17025, an internationally recognized standard for laboratories conducting testing of all kinds. A particular standard such as ISO 17025 provides one layer of oversight, commonly augmenting regulations set forth by a state regulatory body (for example, the Bureau of Cannabis Control in California, or the Marijuana Enforcement Division4 in Colorado). Under these guidelines, a lab must implement a quality control (QC) program specifically designed to provide confidence in the data.
Having quality control
Such a QC program is typically carried out with a series of positive and negative control samples described below, which together underpin confidence in data integrity and accuracy. These QCs are carried out daily at minimum, often more frequently if multiple analytical batches are run in a single day (an analytical batch in the lab represents a group of client samples, generally limited to 20, qualified by a set of QCs).
Negative controls are run alongside client samples in order to prove there is no source of cross-contamination or artifact that would produce a signal in the absence of sample. Often termed a method blank, this QC-type utilizes the same consumables and reagents as the actual samples but omits the addition of the test aliquot. Therefore, a result of non-detect (ND), or below the limit of quantitation (<LOQ), provides evidence that the successful detection of analyte in true samples is reliably free from cross-contamination or instrument interference.
While negative controls show the absence of signal without the addition of sample, positive controls indicate the ability to produce an accurate result when testing a known quantity. Positive controls such as laboratory control samples (LCS) or matrix spike samples (MSS) generally utilize purchased analytical reference standards from a certified third party to demonstrate successful detection of target analytes. These certified reference materials, or CRMs, are added to the sample preparation process (‘spiked’) and then quantitated by the method (‘recovered’) to show the validity of the result, commonly within 80-to-120 percent of the actual amount added.
The daily QCs are not the only check-and-balance used to demonstrate confidence in laboratory data. Each time a lab instrument is calibrated using third-party CRMs, the calibration is verified by a second source of CRMs to safeguard against any defect in the primary source. One can imagine if a purchased CRM were faulty, using it to calibrate would ultimately result in bad data produced. Therefore, each calibration event must be qualified by an acceptable analytical result utilizing an independent source of the same analytes in the calibration curve, before reporting client data. Independent calibration verification (ICV) is thus another level of protection ensuring data integrity.
Proficiency testing is another layer of laboratory quality assurance and demonstrates laboratory competence for each type of test conducted. Proficiency test samples (PTs) are a type of CRM acquired from a third-party provider, but the concentration of analyte contained in the sample is unknown. The laboratory is required to test PTs and report results up to twice per year, depending on specific accreditation requirements. The lab then receives feedback from the PT provider in terms of acceptance or non-acceptance of its reported values, which either demonstrates accurate testing or necessitates corrective action to determine the root cause of the deviations from the true values. By participating in semi-annual PT programs, the laboratory gains and maintains confidence that its processes and procedures give reliable results—or, alternatively, will be triggered to investigate the cause of erroneous results.
Future compliance
Worth noting in terms of new developments in compliance, as of 2020 a lab should have policies in place to comply with evolving Covid-19 requirements for businesses. For example, in California businesses must implement a site-specific protection plan5, including increased physical distancing, enhanced sanitation of high-traffic surfaces, face-coverings when interacting with coworkers and visitors, and other control measures. Employees should also receive training on how to self-screen for symptoms and stay home when necessary.
Quality management and compliance-based activities are a way of life in the cannabis testing lab. Effective quality management means a commitment to the ‘Say what you do, do what you say’ ethos, by issuance and authorized use of written policies and procedures with meticulous record-keeping to document the activities as they are carried out. Labs with efficient and sophisticated quality management systems in place are best equipped to serve their clients with accurate, defensible, and compliant results.
References cited
- scce-hcca-code-of-conduct.pdf. Accessed May 17, 2020. https://www.corporatecompliance.org/sites/corporatecompliance.org/files/2019-03/scce-hcca-code-of-conduct.pdf
- Metrc Sees Record Growth, Hires New Leadership Team in 2019. metrc. Published December 19, 2019. Accessed May 17, 2020. https://www.metrc.com/post/metrc-sees-record-growth-hires-new-leadership-team-in-2019
- Cannabis Compliance Software | MJ Freeway Business Solutions. MJ Platform. Accessed May 17, 2020. https://mjplatform.com/
- Marijuana Enforcement Division D of R. Retail Marijuana Rules 1 CCR 212-2. Code of Colorado Regulations. https://www.colorado.gov/pacific/sites/default/files/ColoradoRegister.pdf1%20CCR%20212%20-2%20Retail%20Effective%2002022018.pdf
- State of California. Statewide industry guidance to reduce risk. Accessed May 17, 2020. https://covid19.ca.gov/industry-guidance/
