Cannabis Testing Lab Compliance: A Step-by-Step SOP

Cannabis testing lab compliance isn't optional — a single procedural gap can cost your lab its state license. This guide walks QA managers and lab directors through building a defensible, audit-ready compliance workflow from sample intake through certificate of analysis (COA) delivery.

Before You Start: Prerequisites

Before building or auditing your compliance workflow, confirm you have the following in place:

• Current state cannabis testing regulations — requirements vary significantly by state (e.g., California BCC vs. Colorado MED vs. Michigan MRA). Pull the active version of your state's testing rules, not a summary.
• Accreditation status — most states require ISO/IEC 17025 accreditation or a state-issued lab license. Know which bodies (A2LA, Perry Johnson, etc.) your state accepts.
• Method validation records — potency, pesticides, heavy metals, residual solvents, and microbials each need documented LOQ, LOD, and matrix spike recovery data before you can report results.
• A chain-of-custody (COC) template — one COC per batch, signed at every transfer point.

If any of these are missing, compliance is a patch job. Fix the foundation first.

Step-by-Step: Building a Compliant Cannabis Testing Workflow

Step 1: Log samples with a unique ID at intake. Assign every incoming sample a unique, non-repeating sample ID the moment it crosses your receiving desk. Record sample weight, condition, client name, and matrix type (flower, concentrate, edible). If your lab uses a LIMS like Aliquora, this ID links every downstream result, instrument run, and COA back to a single sample record automatically.

Step 2: Verify COC completeness before acceptance. Do not begin prep on any sample with an incomplete COC. Check that client contact, sample description, requested tests, and submitter signature are all present. Log rejected or flagged COCs in your intake record with a reason and timestamp.

Step 3: Store samples under documented conditions. Cannabis matrices degrade. Flower and concentrates go to a secured, climate-controlled vault; perishable edibles go to a dedicated refrigerator. Record temperature at intake and at each shift. State inspectors routinely ask for storage logs — gaps here are immediate findings.

Step 4: Run analyses and flag out-of-spec results immediately. When an instrument result exceeds an action limit (e.g., total THC above the 0.3% federal hemp threshold, or a pesticide above state MRL), flag it as OOS before the result leaves the analyst's bench. Do not average a failing result with a passing replicate to clear a sample. Document the raw data, the instrument ID, and the analyst's name.

Common Mistake: Holding OOS results in a spreadsheet "pending investigation" without a formal OOS log. Regulators treat undocumented holds as data integrity violations.

Step 5: Conduct a two-phase OOS investigation.

• Phase I (lab error): Check instrument calibration, blank contamination, sample prep errors, and transcription. If a root cause is confirmed, invalidate the result with a written justification and retest.
• Phase II (genuine OOS): If Phase I finds no lab error, the result stands. Notify the client in writing and issue a failing COA. Do not rework the sample to obtain a passing result.

Step 6: Generate and review the COA before release. Your COA must include: laboratory name and license number, sample ID, client name, collection/receipt/report dates, each analyte result with its unit and action limit, pass/fail determination, and the authorizing analyst or QA manager signature. Have a second reviewer check every COA against the raw data before it goes out — a one-line transcription error on a COA is a regulatory finding and a client trust problem.

Step 7: Archive everything with a complete audit trail. Retention requirements range from 2 to 7 years depending on your state. Store raw instrument data files, COCs, prep worksheets, OOS records, and issued COAs in a system that prevents deletion or untracked editing. An immutable audit trail showing who changed what and when is not optional — it is the difference between a warning letter and a license suspension.

Common Mistake: Saving COAs as editable Word documents on a shared drive. Use a locked PDF with a version hash, or a LIMS that timestamps every revision.

Audit Readiness: What Inspectors Actually Check

State cannabis lab audits are not random. Inspectors follow a standard checklist. Be ready to produce:

• Batch-level traceability — can you show every instrument run tied to a specific sample ID and client?
• OOS log completeness — every flagged result needs a documented investigation outcome.
• Analyst training records — method-specific competency sign-offs, not just general hire paperwork.
• Proficiency testing (PT) results — most states require participation in a PT program (e.g., AAFCO, Emerald, or state-issued PT) and documentation of corrective actions for any PT failures.
• Equipment calibration and maintenance logs — calibration certificates for balances, pipettes, HPLCs, GC-MS instruments, and reference standards.

Run a mock audit with a third-party reviewer at least annually. Use your state's inspection checklist as the scoring rubric.

Frequently Asked Questions

What are the most common cannabis lab compliance violations?

The most frequently cited violations in state audits are incomplete chain-of-custody records, undocumented OOS investigations, missing or expired instrument calibration certificates, and COAs that omit required fields like the lab license number or method reference. Data integrity issues — including results stored in uncontrolled spreadsheets — are also a top finding.

Does a cannabis testing lab need ISO 17025 accreditation?

In most states, yes. California, Colorado, Michigan, and the majority of regulated markets require ISO/IEC 17025 accreditation from a recognized accreditation body as a condition of lab licensure. A small number of states accept a state-issued license in lieu of third-party accreditation, but that is becoming less common as programs mature.

How long must cannabis testing records be retained?

Retention requirements vary by state but typically range from 2 years (minimum) to 7 years. Check your specific state regulations and your accreditation body's requirements — ISO 17025 has its own retention expectations that may extend beyond state minimums. When in doubt, keep records longer.

What triggers a mandatory retest in cannabis compliance?

A retest is triggered when a confirmed lab error (Phase I investigation) invalidates the original result, or when a client formally disputes a failing result through a documented appeal process. Retesting to "find" a passing result without documented justification is a data integrity violation. Most state regulations define retest procedures explicitly — follow your state rules, not internal preference.

Can a cannabis lab use a general LIMS not built for cannabis testing?

Yes, but it requires significant configuration work to meet cannabis-specific requirements like OOS flagging at state action limits, pass/fail COA generation by matrix type, and audit trail controls. A LIMS built with QC workflows already embedded — including immutable audit trails and structured OOS records — reduces the configuration burden and the risk of gaps that show up during audits.