Five Steps to Prepare Cannabis Testing Laboratories for ISO 17025 Audits

Arun Apte;

Five Steps to Prepare Cannabis Testing Laboratories for ISO 17025 Audits

February 3, 2020

By Arun Apte

Publication

Article

Cannabis Science and TechnologyJanuary/February 2020

Volume 3

Issue 1

This tutorial article outlines some of the steps that cannabis testing laboratories can take to prepare ahead of a third-party safety audit.

Photo credit: CloudLIMS

This tutorial article outlines some of the steps that cannabis testing laboratories can take to prepare ahead of a third-party safety audit. It discusses several practical measures that facilities can take to boost their chances of passing an audit, including advice on time management, essential employee training, and laboratory management systems that can ensure a smooth and seamless audit process.

Cannabis is prohibited at the federal level within the United States, though many states have chosen to legalize or decriminalize the drug at the state level. The result of this heavy regional legalization process has been a patchwork of regulations, in which each state can impose vastly different restrictions and freedoms on cannabis businesses.

Regulations in some states now require cannabis testing facilities to pass a third-party audit (1) as part of the licensing process. For example, some states require that laboratories achieve ISO 17025 accreditation-which includes an inspection from a qualified ISO 17025 auditor- to gain their testing license. In other regions, laboratories might choose to undergo an audit voluntarily.

Why Are Third-Party Audits Important?

There are a number of different scenarios that can result in a cannabis testing laboratory needing to pass a third-party audit of their operations.

Some parts of the U.S. require testing laboratories to gain some form of official accreditation-normally the ISO/IEC 17025 standard for testing and calibration laboratories-as an essential part of acquiring their state testing license. In other regions, state regulations are enforced by the state sending out their own auditors to cannabis laboratories to perform inspections (2).

Depending on regional legislation, it may not be required for a cannabis testing laboratory to undergo any kind of third-party audit. Despite this, large numbers of cannabis testing laboratories are electing to get a third-party audit, or to seek accreditations that require the laboratory to pass an external audit. Having this accreditation, or having passed previous third-party audits, can be a way for laboratories to demonstrate their quality and rise above competitors who have not had their methods externally verified in such a manner.

What Is Involved in a Third-Party Audit?

A third-party audit is carried out by a qualified representative of the auditing body-whether that is ISO/IEC or the state department responsible for regulating the local cannabis industry. The auditor has a checklist detailing all of the relevant requirements that the laboratory has to meet to demonstrate compliance and all of the documents and areas of the facility that the auditor must inspect and review.

The laboratory is expected to have copies of all of the relevant documents compiled and available for the auditor to inspect. After these documents have been combed through, the auditor makes recommendations where relevant, and notes any deficiencies they may have observed.

How to Prepare for an Audit

Step 1: Begin Preparations Well in Advance
Preparing for a third-party audit could take a couple of weeks or several months. The time line depends on the nature of the standards that a laboratory is hoping to achieve, the current standards of the operation, and also the extent of the operation. A laboratory that offers a more basic testing regimen will have fewer testing methods that need to be documented, reviewed, and updated where necessary.

Conducting a gap assessment, where the current operations of a laboratory are compared against the eventual audit checklist, can be helpful in assessing what needs to be improved before an audit. This assessment can also help in establishing a time line for how long audit preparations might take.

To prepare fully, it is important to identify all of the areas of operation that will be relevant to the auditing, so that they can be properly handled during the preparation time. It can also be helpful to identify any risks (3) that might affect the laboratory or its reputation-such as the potential for sample collection errors or incorrect data interpretation-so that steps can be taken to proactively lessen the risk of these errors occurring and improve the quality of operations.

Step 2: Get Organized
One of the most important parts of audit preparation is ensuring that all necessary documentation is present and up-to-date.

A large number of documents are required by auditors, including (but not limited to) a quality manual, a scope of accreditation, standard operating procedures (SOPs) for every procedure carried out by the laboratory, training records, and records detailing all testing and calibration procedures. Having all these documents available for the auditor or inspector reduces the time an assessment takes and helps make a good impression.

Good organization can also make it easier for laboratories to identify gaps in their documentation, or documents that have not been updated or reviewed recently.

Using a laboratory information management system (LIMS) (4) can be a great help in organizing the vast amount of documentation needed in a third-party audit. In addition to maintaining laboratory records, many LIMS systems also include functionality that can register and manage all information relating to samples in the laboratory, and support the easy entry and validation of test results data into the laboratory’s records. Using and maintaining an efficient LIMS correctly can make sure that all necessary audit documentation can be easily found during a third-party audit, and can be key in proving data integrity by hosting digital records of all laboratory data that can validate that no data has been tampered with (Figure 1).

Laboratories may also find it helpful to reorganize the audit criteria into a list of objectives, sorted by time frame. Some tasks, such as reviewing the laboratory quality system and documenting employee competency, are required only on an annual basis, where tasks like instrument verification will be required daily or near-daily. By separating the criteria into a list of objectives to complete annually, quarterly, or more frequently, laboratories can guarantee that they are meeting all of the frequency requirements inherent in quality control regulation, and be well prepared for future reassessments or reinspections when a certification needs to be renewed. A time-focused checklist can also help laboratories to roughly estimate how long their preparations for an initial assessment might take.

Step 3: Focus on Teamwork
Preparing for a third-party audit is a large undertaking, especially if this is the first audit a laboratory has had to prepare for. Having a quality or a compliance manager who is responsible for overseeing and directing audit preparation can be of great help.

However, to maximize the chance of performing well in an audit, it is essential to work in a team with the support of management. Passing the first third-party audit or achieving a first independent accreditation requires significant resources, and so having the committed support of those in high-level managerial positions ensures there is sufficient manpower, equipment, and financing behind the effort.

Supportive management will also make it easier to implement staff training and awareness programs, which are essential to ensure quality. To ensure that testing laboratory results are valid and reliable, it is important to have staff who have received proper training and hold the necessary qualifications to carry out their job role effectively. Similarly, to ensure quality and good performance in an audit, it is important to make sure that all staff are well trained and aware of what will be expected of them when operating at this standard.

It may also be advisable to do extra preparation work with staff who will be interacting with the auditors, to ensure that they feel comfortable confidently answering questions about the operation of the testing laboratory in a formal and professional manner-an employee answering with “normally, what we do is…” might leave an inspector with the impression that these quality standards are not normally kept to.

As well as questioning the present operation of the laboratory, the auditor may also ask questions about why a laboratory does not carry out a certain test or test method. In this case, employees should be able to defend these choices using their training, knowledge, and understanding of the laboratory’s goals and capabilities.

Step 4: Have an Internal Audit
Once all documentation is prepared and all laboratory operations are brought in-line with the requirements of the department or accreditation body, the next step in ensuring a successful third-party audit is to carry out an internal audit.

The internal audit is an opportunity to make sure that all audit preparations can be reviewed and deemed acceptable before bringing in an external assessor. In an ideal circumstance, the person or team conducting the internal audit should not be reviewing their own work, to make sure that all parts of the laboratory’s operation are assessed with fresh eyes. Ideally, the internal auditor, or auditing team, should work from a copy of the official audit checklist. This helps to ensure that the internal audit holds the laboratory to approximately the same high standards as the third-party audit when reviewing documentation and inspecting the laboratory apparatus.

The internal audit is also a good opportunity to plan and walk-through the laboratory tour. It is advantageous to know in advance where in the laboratory would be best to stop and discuss with the auditor about the instrument calibration or operation methods being used. Walking the route also helps in making the team more mindful of what might be visible to the final auditor and shed light on restructuring badly organized shelves.

Once the route is decided, it is also advisable to make a note to empty all bins (both physical laboratory bins, and the trash folder on laboratory computers) on the route. It is not unknown for auditors to inspect the contents of paper bins (5) to check for batch records or certificates that have been disposed of before the inspection.

Step 5: Consider an External Preassessment
A less essential-but still beneficial-step in preparations is to consider whether the laboratory would benefit from a third-party preassessment or a mock audit.

There are a number of external consultancy firms who offer audit services for laboratories and other facilities who are preparing for an upcoming regulatory inspection. External preassessment mock audits have several additional advantages to an internal audit. Firstly, the consultant mock auditors bring a wealth of experience in carrying out audits and may be able to spot deficiencies that a less experienced internal inspection team might miss. Additionally, the act of bringing in an external presence to the laboratory-even though it is not the official audit team-could intensify the seriousness of employees that are involved with the mock audit. This can work as a practice session for employees to answer questions from an auditor, and correct gaps, if any, to be filled in employee training.

Conclusion

ISO/IEC 17025:2017 accreditation is becoming increasingly significant for cannabis testing laboratories to demonstrate their technical competency. To prepare your cannabis laboratory for an ISO/IEC 17025 audit by an accreditation body and to get successfully accredited, the cannabis laboratory should obtain an audit checklist and conduct an internal audit to understand if there are any gaps between their systems and the requirements of the standard. Additionally, cannabis testing laboratories should implement quality management systems such as a LIMS to manage documents, training, changes, inspections, nonconformance, and corrective actions, which save significant time of the laboratory staff and in turn, avoid costly mistakes. The success of an audit depends on adequate preparation, the effectiveness of the quality management system, and the laboratory personnel’s training and experience as well as the overall efficiency of processes.