Cannabis Lab 101: Writing SOPs That Survive an Audit

Writing an SOP that survives an audit is not the same as writing an SOP that describes what you do. The gap between those two things is where most cannabis labs lose accreditation findings — and where I spent a disproportionate amount of my bench time cleaning up before assessors arrived. This guide walks through the structure of a defensible SOP, version control that actually works, training records auditors accept, and the recurring findings that accreditation bodies flag most often.

Whether you are a bench technician trying to understand why your lab director keeps rejecting your draft procedures, a lab director building a quality system from scratch, or a grower trying to understand why your testing lab charges what it charges for compliance work — this article gives you the framework to read, write, or evaluate a cannabis lab SOP with confidence.

This article covers:

• What ISO/IEC 17025:2017 actually requires from your document system
• The anatomy of a defensible SOP, section by section
• Version control and approval workflows that hold up under scrutiny
• Training and competence records that satisfy auditors
• The five recurring audit findings you can prevent before the assessor walks in

Step 1: Understand what ISO 17025 actually demands from your documents

The standard does not prescribe a template — it prescribes an outcome, and that distinction is what most labs miss.

ISO/IEC 17025:2017 requires a testing laboratory to document policies, systems, programs, procedures, and instructions to the extent necessary to assure valid test or calibration results. That phrase — “to the extent necessary” — is doing a lot of work. It means the standard is not asking you to write a novel for every procedure. It is asking you to write enough that a competent technician who has never run your method can follow your SOP and get a result that is consistent with what your validated method produces.

Clause 5.5(c) makes this concrete: procedures for laboratory activities must be documented where necessary for consistent application and validity of results. The required documents list that flows from the standard includes your documented scope of laboratory activities, procedures for each activity in scope, competence requirements for personnel, and environmental-condition requirements where those conditions affect results.

State regulators add their own layer. Alaska’s cannabis-testing regulations require SOPs to address reasonably anticipated expected and unexpected scenarios — which is a higher bar than ISO alone sets. New York’s Office of Cannabis Management requires labs to maintain a documented quality system and follow OCM guidance and approved methods. California publishes approved standard test methods and operating procedures that labs must incorporate by reference or adopt directly.

Note: If you are operating under a state cannabis license, your SOP obligations are the union of ISO/IEC 17025:2017 and your state’s cannabis-specific rules — whichever is stricter on any given point controls. Do not assume ISO compliance alone satisfies your regulator.

Step 2: Build the anatomy of a defensible SOP

An SOP that survives an audit has every section present, internally consistent, and traceable to the work actually being performed. Missing a section is a finding; having a section that contradicts your bench practice is a worse finding.

Here is the section structure I use, grounded in what ISO/IEC 17025:2017 and state regulators such as Alaska and Montana require:

• Purpose — one or two sentences on why this procedure exists and what it controls
• Scope — which matrices, instruments, personnel roles, and facility locations this SOP covers
• Responsibilities — who performs, who reviews, who approves
• Definitions — every term of art used in the procedure, defined on first use
• Materials and equipment — specific reagent grades, reference standards, instrument classes, and any environmental conditions that affect the result
• Procedure — numbered, sequential steps written at the level of detail a trained technician needs, not a PhD chemist
• Quality controls — acceptance criteria for every QC element in the run (blanks, spikes, duplicates, calibration checks)
• Calculations — the actual formula, not a reference to the instrument software
• Records — what gets recorded, where, in what format, and for how long
• Deviations — how to request, approve, and document a departure from the written procedure
• Safety — hazards, PPE, waste disposal
• Approval block — author, reviewer, approver, version number, effective date, superseded version

Alaska’s rules explicitly require SOPs to address reasonably anticipated unexpected scenarios — which means your deviations section cannot be a placeholder. Write it as if you expect someone to use it, because eventually someone will.

For method-specific SOPs, link explicitly to your method validation records so the auditor can trace the acceptance criteria in your SOP back to the validation data that established them.

Step 3: Implement version control that holds up under scrutiny

Document-control failures are the single most consistent finding category in ISO/IEC 17025 audits, and they are entirely preventable. Published accreditation-body guidance identifies four specific failure modes: missing approval before issue, unclear revision status, uncontrolled copies, and failure to make the current version available where work is performed.

The fix is a document-control workflow with teeth — not a policy that says you have a workflow.

Here is what that looks like in practice:

• Every SOP carries a version identifier (I use a simple major.minor scheme: v1.0 for initial release, v1.1 for minor edits, v2.0 for substantive method changes) and an effective date
• ISO/IEC 17025:2017 requires documents to be approved before issue by authorized personnel — in most cannabis labs that means the laboratory director’s signature on the approval block before the SOP is released to the bench
• Alaska’s regulations require the scientific director to approve, sign, and date each SOP and each revision; each revision must be submitted to the board within 10 days and may not be implemented until approved by the board or its contractor
• Superseded versions must be removed from points of use or clearly marked as obsolete — a printed v1.0 sitting in a binder next to the instrument while v2.0 is the approved version is a finding
• ISO/IEC 17025:2017 requires amendments to technical records to be traceable — which means your change log must capture what changed, who changed it, and why, not just the new version number

I suggest labs take it a step further and maintain a master document register — a single spreadsheet or database row per SOP showing current version, effective date, next scheduled review date, and the location of the controlled master copy. An auditor who asks “how do you know this is the current version?” should be able to get a complete answer in under two minutes.

Note: Annual review is the minimum. Alaska requires annual review and updates when needed. Any equipment change, reagent lot change, regulatory amendment, or failed proficiency test that touches a procedure should trigger an out-of-cycle review regardless of when the annual review is scheduled.

Step 4: Build training records that demonstrate competence, not just attendance

This is the area where I see the most well-intentioned labs fail. They have training logs. The logs show dates and signatures. The auditor asks: “How do you know the technician can actually perform this procedure correctly?” and the answer is a long silence.

ISO/IEC 17025:2017 requires documented competence requirements for personnel and personnel records that demonstrate those requirements were met. Attendance at a training session is evidence of exposure, not evidence of competence.

A defensible training record system has three layers:

1. Competence requirements per role — a written description of what a technician in a given role must be able to do, tied to the SOPs they are authorized to perform. This is a required document under ISO/IEC 17025:2017.

2. Training records per SOP — for each SOP, a log showing who was trained, by whom, on what date, and on which version of the procedure. When you release v2.0 of an SOP, every authorized technician needs a new training record for v2.0. The old record for v1.0 does not carry over.

3. Competency evaluation records — evidence that the technician was observed performing the procedure and met the acceptance criteria. APHL’s ISO/IEC 17025 document repository includes a personnel training and evaluation procedure and a method-training competency form that labs can adapt — I recommend starting there rather than building from scratch.

Published ISO/IEC 17025 guidance identifies training, qualification, management, support, and documented personnel records as the core elements of a compliant personnel system. The BELAC assessment guidance adds that personnel must be demonstrably competent, impartial, and able to work in accordance with the management system — all three, not just the first.

Note: For labs with high technician turnover — which describes most cannabis labs — build the competency evaluation into your onboarding checklist so it cannot be skipped under schedule pressure. A new hire who runs samples before their competency evaluation is documented is a finding waiting to happen.

Step 5: Audit-proof your system against the five recurring findings

The following five control areas appear consistently in published accreditation-body guidance as recurring nonconformities. None of them require you to change your science. All of them require you to change your paperwork discipline.

1. Missing approval before issue. ISO/IEC 17025:2017 requires documents to be approved by authorized personnel before release. Fix: no SOP goes to the bench without a completed approval block carrying the approver’s name and date.

2. Unclear or absent revision status. Every page of a controlled document should carry the version number and effective date — not just the cover page. Fix: put the version number in the footer of every page so a loose sheet can be traced back to its parent document.

3. Uncontrolled copies circulating on the bench. A printed copy without a “controlled copy” stamp or equivalent is an uncontrolled copy. Fix: either go fully electronic with a system that serves only the current version, or implement a physical controlled-copy register and stamp every issued print.

4. Non-traceable amendments to technical records. ISO/IEC 17025:2017 requires amendments to technical records to be traceable. A correction fluid line or an unmarked overwrite is a finding. Fix: single-line strikethrough, initialed and dated, for paper records; audit-trail-enabled software for electronic records. APHL’s repository includes a procedure for backup, restoration, and testing of electronic backup records — relevant if your records are electronic.

5. Inadequate personnel competence records. ISO/IEC 17025:2017 requires both documented competence requirements and records demonstrating those requirements were met. Fix: see Step 4 above. This is the finding most labs think they have covered and most often do not.

For a broader look at the accreditation process itself, the ISO 17025 audit preparation guide on Lab Overflow covers the assessment timeline and corrective action process in detail.

Quick answers

What sections must a cannabis lab SOP include to satisfy ISO 17025? ISO/IEC 17025:2017 requires procedures to be documented to the extent necessary to ensure consistent application of laboratory activities and valid results, so a defensible SOP should cover purpose, scope, responsibilities, materials, equipment, method steps, quality controls, records, deviations, and approval status. There is no single mandated template, but accreditation bodies expect every section to be present and internally consistent. State regulators such as Alaska add explicit requirements — approval, signature, date, and annual review — on top of the ISO baseline.

How often does a cannabis lab SOP need to be reviewed or updated? ISO/IEC 17025:2017 requires documents to be periodically reviewed and updated, and Alaska’s cannabis-testing regulations set a minimum annual review cycle with corresponding updates when needed. Most accreditation bodies treat “periodic” as at least annually unless a method change, equipment swap, or regulatory amendment triggers an earlier revision. Every revision must carry a new version identifier and go through the same approval chain as the original.

What are the most common SOP-related findings in an ISO 17025 audit? Published accreditation-body guidance consistently flags five control areas: missing approval before issue, unclear or absent revision status, uncontrolled copies circulating on the bench, non-traceable amendments to technical records, and inadequate or missing personnel competence records. None of these require exotic fixes — they are document-discipline problems, not science problems. Addressing them before the audit is a matter of building the right workflow, not rewriting your chemistry.

Can a technician deviate from an SOP during a run, and how does that get documented? Deviations are allowed but must be pre-approved by the laboratory director or quality manager and documented before the work proceeds — Alaska’s cannabis-testing regulations state this explicitly. An undocumented deviation found during an audit is treated as a nonconformity regardless of whether the analytical result was correct. The deviation record should capture who approved it, why, what was done differently, and whether the change affected result validity.

What training records does ISO 17025 require labs to keep? ISO/IEC 17025:2017 requires documented competence requirements for each role and personnel records that demonstrate those requirements were met. In practice that means job descriptions with competence criteria, training logs tied to specific SOPs and their version numbers, and evidence of competency evaluation — not just attendance at a training session. APHL’s ISO/IEC 17025 document repository includes a personnel training and evaluation procedure and a method-training competency form that labs can adapt.

Do state cannabis regulations require SOPs beyond what ISO 17025 demands? Yes — licensed cannabis-testing states layer additional SOP requirements on top of ISO/IEC 17025:2017. Alaska requires SOPs to address reasonably anticipated expected and unexpected scenarios, requires the scientific director to approve, sign, and date each SOP and each revision, and each revision must be submitted to the board within 10 days and may not be implemented until approved by the board or its contractor. New York’s Office of Cannabis Management requires labs to maintain a documented quality system and follow OCM guidance and approved methods. California publishes approved standard test methods and operating procedures that labs must follow for specific matrices and methods.

Sources

• APHL ISO/IEC 17025:2017 Document Repository
• BELAC ISO/IEC 17025:2017 Assessment Guidance
• ISO/IEC 17025:2017 Required Documents and Records — 17025store
• Alaska Cannabis Testing Regulations
• Alaska 3 AAC 306 Cannabis Regulations
• CROSQ ISO/IEC 17025:2017 Guidance — OAS
• NATA ISO/IEC 17025:2017 Presentation
• California DCC Approved Standard Test Methods and Operating Procedures
• New York OCM Cannabis Laboratories
• Montana Quality Assurance Testing Protocols
• ISO/IEC 17025:2017 Standard