Cannabis Testing Lab Certification: How to Prepare Cannabis Testing Labs for ISO 17025 Audits

In 1973 Oregon was the first U.S. member state that decriminalized cannabis. California, in 1996 became the first state to legalize the medical use of cannabis. In 2012 Colorado and Washington became the first states to legalize the recreational use of cannabis. As of 2019, thirty-three states, four of the permanently inhabited U.S. territories, and the District of Columbia have legalized medical cannabis. Globally, cannabis is legalized in forty-four countries, with four countries legalizing recreational use of cannabis.

With the rapidly growing industry and production of cannabis-based products, the need for cannabis testing certification emerges, where their safety, efficacy, and quality will be guaranteed. Market needs for cannabis-based products vary from country to country, but all require the need for testing of cannabis as raw material and cannabis-based products, whether it is a test for cannabinoids content and potency, microbiological purity, terpenes, residual solvents, heavy metals, or pesticides testing. Accredited laboratories are obligated to support the conformity of their tests and by that to contribute to the overall health and well-being of consumers of these products.

By successfully completing ISO/IEC 17025:2017 accreditation and implementing its standards, one laboratory gains international recognition for its commitment to quality and technical competence, and by that eases access to the international marketplace. This shows potential customers that the laboratory values quality and follows steps that ensure that its calibration or testing results are accurate and reliable.

Things to consider before applying for cannabis testing certification

Before a cannabis testing laboratory approaches to ISO/IEC 17025:2017 accreditation body, a few preliminary steps need to be taken into account:

• Implementing a management system that meets ISO/IEC 17025:2017 management and technical requirements
• The laboratory needs a well-written quality manual or equivalent document that specifies all quality-related policies, procedures, and technical practices. This document contains a quality policy statement describing overall quality objectives and must accurately represent the laboratory’s management system.
• The laboratory’s management system before applying for accreditation is obligated to be in operation for a minimum of three to six months so that employees get familiar with the system. During this period an evidentiary trail of documents has to be created for auditors to review. [1]

A quick walkthrough of the accreditation process

When a formal application is filed and all paperwork is submitted, the laboratory’s quality manual is audited by the accreditation body. If documentation gaps are found, the laboratory will be asked to implement corrective actions before scheduling the assessment. After a thorough review of the quality manual and confirmation that the laboratory’s management system meets all ISO/IEC 17025:2017 requirements, an on-site assessment of the laboratory is scheduled.

The purpose of the auditor’s body assessment is to ensure that the laboratory conforms to all ISO/IEC 17025:2017 and is capable of completing all types of cannabis tests within its scope.

To help the laboratory improve its performance, auditors may also provide recommendations based on the observations during the audit. Afterward, audit findings are reported in the assessment report generated by the accreditation body and if any minor or major nonconformities were observed, the laboratory has to take corrective actions to resolve any of the noted nonconformities in the assessment report, in order to achieve ISO/IEC 17025:2017 accreditation.

Major nonconformities are categorized as findings that directly affect the integrity of the quality system and by that the integrity of generated cannabis testing results.

On the other hand, minor nonconformities are categorized as incidents that fail to meet the ISO/IEC 17025:2017 standard without providing any major consequences.

The laboratory is requested to respond within one month to all noted nonconformities with either corrective and preventive action (CAPA) plan or to present a justification for disbelief of stated nonconformities.

The corrective action response must include a copy of objective evidence in order to indicate that corrective actions have been implemented. Every laboratory that fails to respond in writing within four months in the next contact with the accreditation body is treated as a new accreditation applicant.

For every ISO/IEC 17025:2017 accredited laboratory a full on-site reaudit is scheduled at least every two years. If customers of accredited laboratories indicate that significant technical changes have occurred in the testing laboratory, interventional reaudits may also be conducted.

Before each reaudit, a renewal questionnaire is sent in advance to allow sufficient time for the laboratory to complete the renewal process. Before any laboratory accreditation is extended for another two years, a successful on-site reaudit must be completed, with all deficiencies resolved. [1]

Useful information about the Accreditation Body before applying for certification

When selecting an accreditation body, it is extremely important to look at the relevant qualifications of this subject.

Every accreditation body has to be recognized by an international, regional, or national recognition body such as the National Cooperation for Laboratory Accreditation (NACLA), the International Laboratory Accreditation Cooperation (ILAC), the Asia-Pacific Laboratory Accreditation Cooperation (APLAC), or the European Cooperation for Accreditation (EA).

There should be a publicly available listing provided by the accreditation body of all its ISO/IEC 17025:2017 qualified auditors with experience and expertise in the appropriate cannabis testing scope.

Every accreditation body must conform to ISO/IEC 17011, General Requirements for accreditation bodies accrediting conformity assessment bodies.

Before asking for the services of an accreditation body, it is a good idea to make sure that the organization meets the above-mentioned qualifications. [1]

General requirements in the management of ISO/IEC 17025 accredited laboratory (Clause 4)

Impartiality

Every accredited laboratory of this type needs a structure and management that will be committed to impartiality, where no commercial, financial or other types of pressure will cause such a threat.

The laboratory shall identify risks to its impartiality on an ongoing basis and if such risk is identified, the laboratory shall demonstrate a plan for handling, minimizing, or eliminating such risks.

The purpose of this clause is to safeguard against conflict of interest, prejudice, favoritism, one-sidedness, favor, or bias that could result in a harmful or damaging influence on the laboratories activities. [2]

Confidentiality

For all obtained and created information during the performance of an accredited laboratory, there shall be legally enforceable confidentiality commitments to inform the customer in advance of the information it intends to place in the public domain.

The purpose of the confidentiality clause is to cover legally binding duties to both internal and external parties. When required by law or authorized by contractual agreement, the laboratory shall inform the customer, unless prohibited by law, of any attempts of releasing confidential information. [2]

Structural requirements in the management of ISO/IEC 17025 accredited laboratory (Clause 5)

The accredited laboratory shall define its organization and management structure, and its connection to any other organization. Relationships between management, technical operations, and support services also shall be stated, by specifying the responsibilities and interrelationships of all personnel who manage, perform, or verify work affecting the results of the laboratory activities.

To ensure consistent application of all laboratory activities and validity of its results, the laboratory must thoroughly prescribe and document its operating procedures.

Irrespective of other responsibilities, the laboratory personnel shall have appointed authority and resources needed to carry out duties such as identification of deviations in the system, initiation of actions to prevent or minimize such deviations, evaluation of the performance of the management system/laboratory activities and suggestions for their improvement. [2]

Resource requirements in the management of ISO/IEC 17025 accredited laboratory (Clause 6)

All personnel of the accredited laboratory that takes part in the laboratory activities shall be competent, act impartially, and work in accordance with the laboratory’s management system.

The laboratory shall document the competence requirements for each role affecting the results of laboratory activities, including requirements for education, qualification, training, technical knowledge, skills, and experience.

The areas intended for laboratory activities and their environmental conditions shall not compromise the validity of results in any way. The requirements for facilities and environmental conditions necessary for the performance of the laboratory activities shall be controlled, monitored, and documented with relevant specifications, methods, or procedures.

Prevention of contamination, interference, adverse influences between laboratory activities, and other controlling measures shall be implemented, monitored, and periodically reviewed in the accredited laboratory.

The laboratory shall ensure that all of the externally provided products and services that affect laboratory activities are intended for incorporation into the laboratory’s own activities. There shall be a well-written procedure for defining, reviewing, and approving the laboratory’s established requirements for any externally provided products and services. [2]

Equipment requirements in the management of ISO/IEC 17025 accredited laboratory

The equipment of one accredited laboratory shall consist of but is not limited to, measuring instruments paired with adequate controlling software, measurement standards, reference materials, reference data, auxiliary apparatus, etc.

All reference materials that are intended to be used in the laboratory should be used from producers that meet ISO 17034.

Before being placed into action, all laboratory equipment shall be verified that conforms to specified requirements. When laboratories use their equipment outside its permanent control, they shall provide evidence and justify that the requirements for that particular equipment are met.

In order to ensure the proper functioning and prevent deterioration of the equipment, the laboratory shall have a well-written procedure for its usage, handling, transport, storage, and preventive maintenance.

The equipment used for the measurement shall be capable of achieving the measurement accuracy or measurement uncertainty required to provide a valid result. When measurement accuracy or measurement uncertainty affects the validity of the reported results, calibration shall be performed on the measuring equipment.

A calibration program shall be established by the laboratory and adjusted according to the equipment in order to maintain confidence in the calibration status. All equipment in the laboratory that is required to be calibrated periodically, shall be coded/identified and labeled accordingly, to allow the user to easily identify the calibration status and the period of validity of the instrument.

Any instrument that shows to be outside of specified requirements or defective, has been mishandled, has been subjected to overloading, and gives questionable results, shall be taken out of service. If not isolated from the laboratory, the instrument shall be clearly labeled as being out of service, until it has been verified to perform correctly.

When such cases emerge, the laboratory shall examine the effect of the defect on the tested samples and document all important information in a deviation report according to well-written procedures for deviations/nonconformities.

All records generated from an instrument that influences laboratory activities shall include the following information: the identity of the instrument, including software and firmware build version, serial number, or another type of unique identification, evidence of verification that the equipment conforms with specified requirements, documentation of used reference materials and their relevant information, etc. [1]

Process requirements in the management of ISO/IEC 17025 accredited laboratory (Clause 7)

Verification and validation of measurement procedures (methods)

All methods, procedures, and supporting documentation shall be kept up to date, regularly revised, and shall be readily available to personnel when needed. All international, national, or regional standards that contain concise information on how to perform laboratory activities and are written in a way that can be used by the operating personnel in a laboratory, are not required to be part of internal operating procedures.

When a specific method is not appointed by the customer for specific testing, the accredited laboratory shall select an appropriate method (international or laboratory-developed) for the testing and inform the customer about the chosen method. Before committing to any testing, the laboratory shall perform a verification of the method, to ensure that the method can achieve the required performance.

Deviations from methods shall occur only if they are documented and technically justified accordingly, and also accepted by the customer. All non-standard, laboratory-developed, and standard methods that are intended to be used outside their intended scope shall be validated as extensively as necessary to meet the needs of the given application or field of application. If certain changes to an already validated method are found to affect the original validation, a new method validation shall be performed. [1]

Managing technical records

For each laboratory activity, technical records documentation shall contain the results, data reports, identification factors that are affecting the measurement result, and its measurement uncertainty. Technical records shall include the date of performing the activity and the identity of the personnel responsible for each laboratory activity. Original observations, data, and calculations shall be recorded at the time when an analysis is conducted.

The laboratory shall ensure that technical records can be tracked to previous versions or originally generated records after instrument acquisition. Both the original and amended data shall be kept, including the date of modification, an indication of the altered aspects, and the personnel responsible for performing the alterations. [1]

Measurement uncertainty in accredited laboratories

For each measurement, laboratories shall identify the contribution to measurement uncertainty. All contributions which are of significance should be taken into account for the final result using appropriate methods of analysis. In cases where laboratories are capable of demonstrating that critical influencing factors are under control, there is no need for the evaluation of measurement uncertainty for each result. [1]

Reporting of results

Prior to release, all test results shall be reviewed and authorized. They shall be provided clearly, accurately, unambiguously, and objectively, usually in a form of a report. Reports can be issued as hard copies or in digital format.

To minimize any possibility of misunderstanding or misuse, each report shall include:

• a title (indicating the nature of the document) the name, address, and contact information of the laboratory performing the tests
• unique identification of the report as a complete document, with clear indications for the beginning and the end of the report
• the name, address, and contact info of the customer identification of the used methods
• a clear description of the condition for the received item and unambiguous identification
• date of receipt, date of testing, and date of sampling (if critical for validity of results)
• date of issue of the report
• the results with units of measurement, if applicable
• test conditions / environmental conditions and measurement uncertainty (expressed in the same unit as the measurement) that applies to the result for certain measurement
• deviations, additions/exclusions from the method
• identification of the person(s) authorizing the report
• additional information which may be required by a specific subject or customer

Note: The laboratory shall be responsible for all information provided in the report. If the laboratory is not responsible for the sampling stage, a disclaimer shall be put stating that samples were provided by the customer and results apply to the sample as received.

When sampling is performed by the laboratory, test reports shall include the following additional information:

• date of sampling
• unique identification of the sampling material
• location of sampling
• a reference to the sampling plan and sampling method
• environmental conditions during sampling that may affect the integrity of the sample

When a statement of conformity to a specification or standard is provided, the laboratory shall document the decision rule employed, taking into account the level of risk associated with that decision rule, and apply the decision rule. If the decision rule is prescribed by the customer, regulation, or normative documents, further consideration of the level of risk is not necessary.[1]

Handling complaints

The laboratory shall generate a documented process to receive, evaluate and make decisions on complaints. A detailed description of the process of handling complaints shall be well documented and available to any interested subject on request.

After receiving a complaint, the laboratory shall investigate and confirm whether the complaint is related to laboratory activities. The laboratory shall be responsible for any decisions making at all levels of the handling process for complaints.

For all laboratory activities and results that do not conform to its procedures or the agreed requirements by the customer, the laboratory shall have a thoroughly described procedure. In this procedure, all responsibilities and authorities for the management of nonconforming work shall be defined. All initial actions are based upon scientifically sound approaches and risk levels established by the laboratory. The significance of the nonconforming result is evaluated accordingly, including an impact analysis on previously generated results of this nature.

A decision is taken on the acceptability of the nonconforming work, and where necessary, the customer is notified about the nonconformities, and work is recalled. The laboratory shall implement corrective actions when evaluation indicates that nonconforming work could recur. [1]

Control of generated data within the laboratory

Laboratories shall have access to data and information needed to perform laboratory activities. The laboratory information management system (LIMS) used for data collection, processing, recording, reporting, storage, and retrieval of data shall be validated for functionality, including the proper function of interfaces within the LIMS before being used in the laboratory. In case of any changes/updates including laboratory software configuration or modifications to commercial off-the-shelf software, these changes shall be authorized, documented, and validated before being put in use. All calculations and data transfers shall be checked appropriately and systematically. [1]

Management system requirements in the management of ISO/IEC 17025 accredited laboratory

Cannabis laboratories shall establish, document, implement and maintain a management system that is capable of supporting and demonstrating consistent achievements of the requirements and assuring the quality and integrity of all generated laboratory results. In addition to the previously mentioned requirements, the laboratory shall implement a management system in accordance with two options:

Option A

At a minimum, the management system shall address the following activities:

• Management system documentation
• Control of management system documents
• Control of records
• Actions to address risk and opportunities
• Improvement
• Corrective action
• Internal audits
• Management reviews

Option B

If the laboratory already established and maintains a management system, in accordance with the requirements of ISO 9001, and shows the capability of supporting and demonstrating the consistent fulfillment of the requirements of Clauses 4 to 7, shall fulfill at least the intent of the above-stated management system requirements for option A. [1]

Have you tried performing internal audits in your laboratory? A good practice that provides great results.

In order to identify more efficiently gaps and drive improvements, cannabis laboratories shall have periodical programs of internal audits to assess whether their operations comply with ISO/IEC 17025:2017 standard. It is important to always be noted that the purpose of these activities is not to find “fault” and cast blame on employees. In fact, internal audits appear to be healthy habits with an open, fair, and collaborative spirit where technical auditors and auditees clearly communicate and identify present gaps together through a positive audit culture, in order to improve the standard. This kind of audit also encompasses a tour of the laboratory, so practicing this may also be beneficial to identify any areas of the route that may need to be reorganized, and where may be best to discuss procedures with the auditor. When conducting internal audits, it is extremely crucial to maintain the same professional behavior and focus, in order to gain new skills, while at the same time becoming more familiar and prepared for the awaiting assessment by the accreditation body. [3]

What are the three types of audits?

Witnessing

Witnessing is the act of observing an auditee while performing daily laboratory tasks. The auditor will usually ask to be provided with the relevant document for a certain test method against which compliance is to be assessed.

Vertical audits

In vertical audits, auditors will select a single report or reported result upon which they will either work systematically backward, from the generation of the report to the registration of the sample in the laboratory, or forward from the sample registration.

Horizontal audits

In horizontal audits, compliance is assessed across all test methods or activities within the scope of accreditation, where all technical clauses could be involved. [3]

ISO 17025 internal audit checklist

During technical audits, suitable techniques are used to collect and verify supplied information, document all observations, and record findings against technical audit criteria. Internal auditing techniques usually include the use of checklists, questioning and listening during interviews, witnessing daily task activities, and document reviews.

An ISO 17025 internal audit checklist is a great tool used by laboratory managers to determine if their laboratory meets the required competencies for testing and calibration. It is based on the above-mentioned clauses: general, structural, resource, process, and management system requirements. [3]

Close encounter with the accreditation body

Very often, certification auditors are perceived as not very open-minded and will insist on a tremendous amount of unnecessary documents while giving totally redundant remarks. Truth be told, this is almost never the case. If we try to understand how auditors think and what is their actual purpose, accreditation audits can turn out to be a much more pleasant and useful experience.

To be ready for an audit means that the laboratory in question possesses evidence of conformity for each of the clauses of the specific ISO standard while working carefully through the implementation of each part. The ISO management system standards are very specific and precise. Generally, the standard will guide you through what you have to comply with and what you have to do to comply, but auditors will certainly ask questions aside from the basic theory for a certain standard.

One of the questions that an auditor will certainly ask is “What is your purpose in pursuing this accreditation?”. Hopefully, your answer will lead to the necessity for improvement in quality and technical competence of the laboratory to provide accurate and reliable testing results, while satisfying all interested parties in the most efficient way possible. Understanding the basic purpose of the ISO accreditation is fundamental in the beginning process of accreditation, so hopefully, your answer to the previous question will not go in a direction where you are seeking accreditation just because your customer or partner is pressuring you to close a certain deal.

By proving that you comply with every clause and salient point of the standard, you also need to demonstrate that you understand the purpose behind the standard. Never make things up in front of the auditor just to satisfy his needs, but always be truthful and honest. Always answer the questions to the best of your knowledge. If you happen to don’t know the answer, tell the auditor that you will find out. Display a positive attitude and be willing to explain in detail. However, be cautious to be precise in your answers, without too much hesitation and showing uncertainty.

Just as one laboratory is needed to meet the requirements of the ISO standard, the auditors also have a standard that they have to follow. They are there only to verify the conformance of the processes against the standard. If they happen to find any non-conformities, it is their duty to point them out. Non-conformities cannot be raised unless there is a written requirement and relevant evidence is provided.

Nonconformities are known as non-fulfillments of requirements and are generally divided into two different types by the accreditation bodies: minor and major nonconformities. Both need to be addressed, but classification in severity plays a big role when it comes to the decision if certification is about to be granted.

A minor nonconformity would be the failure to conform to a requirement that in the auditor’s judgment and experience is not likely to result in a failure of the quality management system. It may be a single observed lapse or isolated incident where there is minimal risk of a nonconforming product being released to the customer. Examples of minor non-conformities would be documents with an unauthorized change, improper calibration of an instrument, a missing training record, incorrect labeling of reference materials, or an instrument past its calibration date.

Major nonconformities are typically seen as a breakdown of a requirement of the management system. For example, the ISO requirements state that it is needed to prevent the unintended use of obsolete documents, and for this to be addressed, it should be stated in a procedure that employees are not allowed to print out copies of documents to keep at their desks and they need to use the version available on the intranet. If the auditors find out that employees across the laboratory are using printed versions of older procedures for their work, this could be seen as a major nonconformity. Other examples of major nonconformities would be the absence of a required documented procedure, falsified test results, document changes routinely made in an unauthorized way, or product being approved before testing has finished.

No matter if they are minor or major, raised nonconformities shall not be experienced in an unpleasant way. They should be addressed in the same way they are handled with the company’s internal corrective and preventive action process. The only difference is that the plan will be reviewed by the accreditation body. Be aware that your response will be recorded for all minor nonconformities in their audit report and they will follow up on the completion of the corrective actions, at their next audit visit. For major audit nonconformities, the accreditation body will set up a specific timeline for the implementation of the corrective actions, after which they may require to perform a follow-up audit to verify that the process is working. Once they are satisfied that the actions are completed, they will issue the certificate. [4]

Hiring an external consultant when applying for cannabis testing certification

It is a good practice to hire an external expert for a mock assessment and to look through your processes since they can find things that are hard to be spotted by an internal observer. Not only can you ensure that all your boxes are ticked, these auditors typically have a lot of experience and knowledge in the area, and therefore may be able to advise on improving areas that haven’t been picked up in an internal audit. It also provides a more realistic scenario for employees who may have to answer questions from the auditor. Sometimes being thoroughly focused on certain segments in your system, makes you forget about connections between internal processes and how are they affected one by the other. Having an experienced consultant review the validity of your system and all generated documents will significantly improve your competence when facing audits or follow-ups. [4]

Conclusion

The ISO/IEC 17025:2017 international standard is having an enormous impact on the quality and technical competence of many cannabis testing laboratories around the world, by incorporating valued principles and specifying general requirements, with an aim for laboratories to implement a well-structured laboratory management system.

Preparing for the accreditation audit is as important as all the work and effort put into the implementation of the ISO management system requirements. Possessing the needed knowledge, understanding, confidence, and spirit for an upcoming official audit is one extremely complex and demanding process, for which certain preparations are more than necessary.

Effective and well-organized internal audits within the laboratory, in combination with experienced external consultants, are proved to be excellent tools for testing and improving the readiness of the laboratory for cannabis testing certification.