An Introduction to Cannabis Compliance Testing

There is an increased demand for quality of Cannabis testing as the legalization of Cannabis storms through most to all of the United States and Canada. Unfortunately, as the rise in popularity of cannabis products continues over the years, the regulatory landscape has become substantially more difficult to navigate in the US.

National Cancer Institute @nci

A bill called Farm Bill, created in 2018, efficiently separates federal laws around two types of Cannabis plants: cannabis and hemp. The popularity of both articles of plants is causing both the cannabis and hemp industry to evolve rapidly alongside the continuous legislative changes in order to address public health concerns. Due to these quick and ongoing changes, Cannabis testing facilities are finding it particularly more difficult to navigate through.

To make things a bit easier to understand, there are overall 3 fundamental compliance topics to keep in mind:

1. Quality and Calibration of laboratory equipment
2. Data Retention (bookkeeping)
3. Data integrity controls

These three topics mentioned above are the key to ensuring that an active cannabis testing facility is compliant with state regulations and can maintain ISO 17025 accreditation. Eventually, it will be no surprise that the laboratory regulations will become more stringent, and thus ISO 17025 accreditation for an operating testing laboratory will be one of the key essentials in order to succeed in the industry and stand out from the crowd.

What is ISO/IEC 17025 Accreditation?

ISO stands for International Organization for Standardization. ISO 17025 is simply a proof of testing competence and ability to generate valid results via calibrated equipment. The key requirements that the ISO 17025 accreditation outlines are as follows: personnel, equipment, method validation, data management and quality requirements. Most states (excluding Washington) that have legalized recreational cannabis have made ISO 17025 the primary backbone for compliance requirements.

What are the Current Cannabis Compliance Testing Requirements?

In Canada, the compliance testing requirements are laid out clearly in a document which can be accessed on the Government of Canada website. Overall, compliance testing is divided into two categories:

1. Concentration of wanted compounds (e.g. cannabinoids and terpenes)
2. Ensuring that no unwanted compounds (e.g. pesticide, heavy metal, residual solvents, mycotoxins and microbes) exceed the safety limits.

Cannabinoids and Terpenes fall in the first category. It’s not about the presence or absence of these compounds but rather how much is present and as long as it’s within the safety limits. For materials such as hemp, for example, the THC concentration cannot exceed 0.3% w.t, or in edibles where THC levels should be lower than 5mg. Pesticide, mold, heavy metals fall under the second category. The limits for these are very strict and/or should be absent. Depending on the state and country, there are a list of substances and fixed limits available online either on the state or federal government sites.

But it doesn’t stop there. Sure, rules are set… but are they enough? Are those set rules sufficient enough to ensure the safety of consumers and the quality of the cannabis product? Safety to the public can be guaranteed only if ALL harmful compounds have been identified, and unfortunately as of now, there are still many unknowns in the industry. For example, THC distillates usually have a concentration of about 90% in THC and the remaining 10%, are a mixture of other cannabinoids that may or may not have been identified. Another great example is when Vitamin E acetate was showing up in THC vapes and cartridges in 2019. Vitamin E acetate has been linked to lung damage and has hospitalized thousands with vaping-related illness and injury (EVALI). Although, Vitamin E acetate isn’t harmful when ingested as a supplement or applied to the skin, but studies have found that if inhaled it could be lethal.

There are two key challenges that are still unresolved in the cannabis industry: 1) How easily can it be audited, 2) Laboratory procedures – is it reproducible and transparent? One of the biggest questions in the industry is quality.

How is “quality” of a cannabis product being measured and monitored from batch to batch? The cannabis industry is fairly new, which makes these challenges much more difficult to solve easily. But, as the industry matures and we begin to learn more and more about the plant itself, the benefits and detrimental aspects of it all… the more we start to unravel the unknowns.

Good Manufacturing Practices (GMP)

In the United States, the Food and Drug Administration (FDA) does not regulate Cannabis, because it is considered a Schedule 1 substance - categorized with heroin, cocaine, opium, oxycodone, fentanyl, morphine, methamphetamine, and amphetamines. Since it is not regulated at the federal level, rules and regulations are set by each state (states where cannabis is legal) individually and solely independent of one another.

This is why obtaining a Good Manufacturing Practice (GMP) certification by the testing lab will ensure excellence in accuracy and validity in testing. GMP covers all aspects of cannabis testing: from quality control, to complaints and recalls, to personnel handling and equipment requirements. In the states, GMP is not strictly required but in Canada, testing labs do require each testing facility to obtain and maintain GMP certification.

In the pharmaceutical industry, there are many different types of GMP standards but for the cannabis industry the European Union’s GMP (EU-GMP) is used as the gold standard for most.

Based on the current strict regulations and/or lots of ambiguity still present in the cannabis industry, preparing for the future is extremely important for all testing labs. One popular idea that is circulating in the American cannabis industry is this: perhaps obtaining and maintaining GMP certification now might act as some kind of “future- proof” if cannabis is legalized federally.

Compliance Testing Health Canada’s Cannabis Act

In Canada, Health Canada is THE regulator (at the federal level) for maintaining and enforcing compliance policies for cannabis. The main purpose of this policy is to lay out the rules and regulations of Health Canada’s compliance and enforcement activities under the law called the “Cannabis Act”. Similar to the United States, this policy ensures and promotes consistency and transparency within the cannabis industry for testing and maintaining the safety of the public.
This Act includes all aspects and stages of cannabis products, starting from production to distribution, to sales. Not only does it establish a framework for legal means, it also lays out the rules and regulations surrounding each stage of cannabis product development. The primary purpose of this Act is to ensure that public health is protected; public safety is maintained while actively plummeting the businesses of the illegal market. To ensure these objectives are actively met, the Act includes the following:

• A general control framework is set– establishing several criminal prohibitions
• Provides permission of persons to engage in certain cannabis related activities
• Set parameters for operating a legal cannabis business – includes granting of licenses, permits etc.
• Well-defined authorities are set in order to protect health and maintain public safety risks related to cannabis
• Restrict youth access
• Impose serious penalties for those who break the law and/or the “Cannabis Act”

Qualify/calibrate laboratory equipment

Quality management systems put heavy emphasis on ensuring accuracy and precision of laboratory equipment. All licensed lab are required to deliver accurate and precise data, every time. However, what does quality actually mean? Words such as “verify”, “validate”, “calibration” and “qualify” are interchangeably used across labs. Although there are no incorrect definitions, it seems as though labs use the words that suit them best, resulting in inconsistencies across the globe.

Let’s define these words:

Calibrate: To measure the relationship between the equipment indication and a known value. This relationship is then used to measure for correction of the equipment.

Qualify: This proves that the equipment/instrument is functioning correctly and the results are reliable and accurate

Verify: provide evidence such as empirical data, observation, a test or an experiment used to support or justify a hypothesis.

Validate: to perform experiments to prove that instrument is working correctly.

Although these terms are sometimes used interchangeably, it is important to understand the differences in these activities. The complexity arises in a lab as most labs carry a broad spectrum of instruments that require routine maintenance to ensure quality standards are met. For example, it won’t do justice if a balance is compared with a HPLC as one has a more diverse set of outputs and parameters versus the other. A balance records only one format of data, whereas a HPLC measures a variety of parameters such as retention time, temperature, flow rate, pressure etc. It would not make sense to only have calibration data for an HPLC to confirm that the instrument is working at its best.

What is Data Integrity?

It is the accuracy, extensiveness, repeatability and consistency of the data. Alongside this wordy definition, data integrity can also refer to the safety of the data regarding its alignment with regulatory compliance. Data integrity can be maintained by secured bookkeeping, a proper standard operating procedure and collection of rules. Simply, the truthfulness of any data is the core to any scientific method. At the end of the day, the data collected must be documented in such a way that it can be traceable and repeatable.

The Principle: ALCOA+

ALCOA+ is an acronym to evaluate whether the data collected follows the key characterization of data integrity:

Attributable – Who did the work?

Legible – Can it easily be read and traced?

Contemporaneous – Day and time the work was performed.

Original – Is this a novel test or has it been done before?

Accurate – Is the data reliable, valid and correct?

Complete – Are all the data there?

Consistent – Has it been repeated? If so, did the data continuously show the same thing?

Enduring – Is it in a readable format for future reference?

Available – How can it be accessed? Is it easily accessible?

In the end…

“Hiding within those mounds of data is knowledge that could change the life of a patient, or change the world” – Atul Butte