A Guide to Preparing for Colorado Department of Public Health and Environment's Hemp Regulatory Inspection

If you have a hemp manufacturing facility in Colorado, then you already probably know that on July 1, 2024, there were some major changes, depending on what products you produce. If you are not located in Colorado, this may be a trend that is starting, so it might help you to be prepared in case your state starts to implement similar regulations.

Starting July 1, 2024, the Colorado Department of Public Health and Environment (CDPHE) will begin regulating Safe Harbor hemp firms based on their newly revised hemp regulations. These regulations are now entirely separate from the traditional wholesale food manufacturing regulations and permit the infusion of products with intoxicating hemp-derived cannabinoids. A distinctive feature of Colorado’s revised regulations is the allowance for producing both intoxicating and non-intoxicating cannabinoids in the same facility.

If your Colorado company falls under these revised regulations and you are preparing for their inspection, this blog is for you. Preparing for a compliance inspection with regulators involves several steps to ensure your organization is ready to demonstrate adherence to relevant laws, regulations, and standards. Here’s a quick guide to help you prepare. Relevant CDPHE definitions are included at the end of this blog as a helpful reference.

Unique Good Manufacturing Process Audit Requirement for All Safe Harbor Registrants

CDPHE permits the production, handling, packaging, holding, and distribution of Safe Harbor hemp products. Safe Harbor products include intoxicating cannabinoids derived from hemp. The newly revised standards include providing evidence of an inspection by a department-approved third-party auditor by July 1, 2024, and by July 1 of each year thereafter. The department-approved third-party auditor audits against Current Good Manufacturing Practice (cGMP) standards and needs to be an accredited certification company. Now what you need to do is prepare for CDPHE’s audit, find an accredited and CDPHE approved certification company, and pass the required cGMP audit (because if you’re going to pay for the audit you might as well pass it).

Preparing for CDPHE Inspection

1. Understand the Requirements: Familiarize yourself with the specific regulations and standards relevant to the inspection. These regulations outline industry expectations for firms. While there are clear expectations written, there is often flexibility allowing firms to become compliant in ways that best fit their business.

2. Create Documents Required by Regulations: After understanding the standards, create any required documents such as Policies, Standard Operating Procedures (SOPs), and Written Instructions. These procedures must be clear, concise, and include all necessary details and steps. Ensure consistency in format and terminology across all documents. If documents already exist, ensure they are updated to reflect current business practices. In addition to Good Manufacturing Practice documents, CDPHE has a unique Process Validation requirement that needs to be written out, when handling Safe Harbor products in certain situations. Third party consultants can assist you with developing and maintaining SOPs for these requirements.

3. Staff Training: Conduct training sessions to ensure all employees are aware of compliance requirements. Hold a meeting to introduce the new procedures to the team, explaining the purpose, benefits, and expectations. Keep employees informed about the audit process and their roles in it.

4. Implement Documents: Implement the written procedures at the facility. Regulators often want to see evidence that the procedures are being followed regularly. Inspectors will expect to see written logs to verify various compliance activities. Make sure you are keeping all documentation up to date and filled out properly on a regular basis.

5. Conduct a Mock Audit: There are two different type of mock audits you can do: an internal audit or a third-party audit.

- Perform an internal audit to identify potential areas of non-compliance. This will allow the team to conduct a gap analysis to compare current practices with regulatory requirements. Collect and organize all necessary records, reports, and documentation required during the audit. The mock audit should include assessing the physical facility, employee activities, and a document review. Use the results to identify areas for improvement and make necessary adjustments.

- Hiring a third party to conduct a mock audit (also known as a gap analysis) of your facility can be incredibly beneficial. Fresh expert eyes can help identify non-conformances that may have been overlooked internally. If you don't already have a strong internal auditing program in place, this is an excellent starting point. A third-party audit provides insight into building a robust internal auditing system and ensures you are prepared for the next step required by CDPHE—the Accredited Certification Audit.

During the audit, the auditor can also assist in finding the best fit among accredited certification companies. This guidance helps streamline your path to compliance. Visit here to learn more from Allay Consulting about third-party audits and the cGMP audit process overall.

6. Safe Harbor Registrants and cGMP Audit by Third Party Accredited Company: Select an accredited certifying body to conduct the cGMP audit. CDPHE requires this certifying body to be accredited, which means a higher authorization independent third-party oversight checking their standards, credentials, and competence. The accreditation ensures the certifying body’s standards meet and/or exceed a recognized set of standards. Schedule an audit with a CDPHE approved third-party company as soon as possible! All registrants must pass their cGMP audit, which will consist of a certification body auditor spending 1-2 days in your facility conducting a physical audit of the facility as well as a thorough review of your cGMP SOPs and documentation. Working with a cGMP consulting firm such as Allay Consulting will help you pass your audit the first time. Allay Consulting can develop all your cGMP documentation and is accustomed to preparing licensees for this type of audit.

7. Post-Audit Actions: Review the audit report carefully and address any findings or recommendations by submitting a corrective action report back to the certification body auditor.

8. CDPHE Inspection Time: The culmination of all your efforts will prepare the team for the CDPHE inspection. Take a few deep breaths; you got this!

9. Post-Inspection Actions: Review the inspection report carefully and address any findings or recommendations. Develop and implement a plan to address any areas of non-compliance identified in the inspection. Use the inspection findings to improve your compliance programs and practices.

10. Additional Tips: Stay up-to-date with changes in regulations and industry standards. Conduct regular internal audits to maintain ongoing compliance. Train, train, train! Regularly revisit your procedures and documentation to ensure they align with the latest regulatory requirements and best practices. Continuous improvement is key to maintaining compliance and operational excellence.

By following these steps, you can effectively prepare for a compliance audit and demonstrate your organization’s commitment to regulatory compliance. Navigating through CDPHE’s updated hemp regulations and preparing for a comprehensive third-party cGMP audit may be challenging for any company, but we are here to support the industry. Based in Colorado, Allay Consulting is here to guide you through the cGMP audit requirements and state compliance.

CDPHE Definitions Applicable to this Blog:

• Intoxicating cannabinoid: Any of the following in an amount that exceeds the amount established by rule or, if no rule establishes the amount, in any amount: Delta-10 tetrahydrocannabinol (THC) and its isomers; Delta-9 THC and its isomers; Delta-8 THC and its isomers; Delta-7 THC and its isomers; Delta-6a, -10a THC and its isomers; Exo-tetrahydrocannabinol; Metabolites of THC, including 11-hydroxy-THC, 3-hydroxy-THC, or 7-hydroxy-THC; Hydrogenated forms of THC, including hexahydrocannabinol, hexahydrocannabiphorol, and hexahydrocannabihexol; Synthetic forms of THC, including dronabinol; Ester forms of THC, including delta-8 THC-O-acetate, Delta-9 THC-O-acetate, and hexahydrocannabinol-O-acetate; Tetrahydrocannabivarins, including Delta-8 tetrahydrocannabivarin but excluding Delta-9 tetrahydrocannabivarin (THCV); Analogues of tetrahydrocannabinols with an alkyl chain of four or more carbon atoms, including tetrahydrocannabiphorols, tetrahydrocannabioctyls, tetrahydrocannabihexols, or tetrahydrocannabutols; and any combination of the compounds, including hexahydrocannabiphorol-o-ester.
• Non-intoxicating cannabinoid: Full spectrum hemp extract that contains no more than 1.75 milligrams of THC per serving and contains a ratio of cannabidiol (CBD) to THC of greater than 15 to one (15:1); Broad spectrum hemp extract; CBD; Delta-9 tetrahydrocannabivarin (THCV); Cannabichromene (CBC); Cannabicitran (CBT); Cannabicyclol (CBL); Cannabielsoin (CBE); Cannabigerol (CBG); Cannabidivarin (CBDV); and Cannabinol (CBN).
• Safe Harbor hemp product: A hemp-derived compound or cannabinoid, whether a finished product or in the process of being produced, that is permitted to be manufactured for distribution, produced for distribution, packaged for distribution, processed for distribution, prepared for distribution, treated for distribution, transported for distribution, or held for distribution in Colorado for export from Colorado but is not permitted to be sold or distributed in Colorado.
• Safe Harbor hemp manufacturer or storage facility or Safe Harbor hemp facility: A facility that manufactures for distribution, produces for distribution, packages for distribution, processes for distribution, prepares for distribution, treats for distribution, transports for distribution, or holds for distribution a safe harbor hemp product.

It is a big task to take on, but this industry is resilient and able to overcome any obstacle. Follow the steps above and you will make it through the Safe Harbor gantlet. There are always third-party consultants that can train your staff, write the required SOPs, help you find an accredited certification company, and assist with the audit itself. I hope this information helped and good luck out there!

About the Author

Kim Stuck is the CEO and founder of Allay Consulting. Direct correspondence to: kim.stuck@allayconsulting.com.