Overview
CCC did not ensure that MEs and independent testing laboratories (ITLs) reported positive pesticide tests to CCC within 72 hours as required. Specifically, MEs and ITLs did not report positive pesticide tests until 4 to 16 days after the possibility of pesticide contamination was known from test results in 22 of 58 instances during the audit period. Additionally, we found 1 instance where the ITL did not report a positive pesticide test to CCC at all.
If CCC does not ensure that positive pesticide tests are reported on time, CCC’s ability to investigate possible pesticide violations, and protect consumers, could be impaired.
Authoritative Guidance
Section 15(a)(3) of Chapter 94G of the Massachusetts General Laws states, “An independent testing laboratory shall report any results indicating contamination to [CCC] within 72 hours of identification.”
According to 935 CMR 500.160(3), which was in effect during the audit period,
A Marijuana Establishment shall have a written policy for responding to laboratory results that indicate contaminant levels are above acceptable limits established in the protocols identified in 935 CMR 500.160(1).
(a) Any such policy shall include:
- notifying the Commission within 72 hours of any laboratory testing results indicating that the contamination cannot be remediated and disposing of the Production Batch.
- notifying the Commission of any information regarding contamination as specified by the Commission or immediately upon request by the Commission.
(b) The notification shall be from both the Marijuana Establishment and the Independent Testing Laboratory, separately and directly.
Reasons for Issue
CCC did not have adequate policies and procedures, including a monitoring component, to ensure that MEs and ITLs report positive pesticide tests to CCC within 72 hours of identification. Although Metrc has reports available that can identify positive pesticide tests, CCC did not use these reports to monitor MEs’ and ITLs’ compliance with reporting requirements.
Further, CCC did not have adequate policies and procedures to ensure that ITLs’ standard operating procedures include instructions for responding to laboratory results that indicate that contaminant levels are above acceptable limits. We reviewed the standard operating procedures that were in effect during the audit period for both ITLs that operated during the audit period and found that neither included instructions for reporting positive pesticide tests to CCC.
Recommendations
- CCC should use existing Metrc capabilities to create a report that identifies all positive pesticide tests for CCC’s Investigations and Enforcement Unit to monitor MEs’ and ITLs’ compliance with reporting requirements.
- CCC should develop adequate policies and procedures to ensure that ITLs’ standard operating procedures include instructions for responding to laboratory results that indicate that contaminant levels are above acceptable limits.
Auditee’s Response
The Commission agrees with the recommendations in this finding. We disagree, however, with the finding that the Commission did not have controls; in fact, in the case of pesticide testing, the Commission’s controls were effectively deployed and worked. During the audit period, Enforcement staff issued NODs, started an investigation, and came to an agreement with a Licensee that resulted in a financial sanction and, importantly, operational corrections to deter future risk.
Regarding second recommendation, we appreciate the observation that the Commission did not have a specific requirement for ITLs to have the 72-hour reporting requirement in their Standard Operating Procedures (SOPs).
Through the audit period to present, all applicants must have a compliant Quality Control (QC) plan, which includes 935 [CMR] § 500.160, before commencing their operations. Review of these documents takes place throughout the licensing process. As part of the licensing process, ITLs must submit SOPs that include instructions for result reporting that indicate contaminant levels above acceptable limits along with other steps to show adherence to the current Testing Protocols. To improve controls for this aspect of licensing, the Commission hired more staff to focus on ITLs, adopted new Testing Protocols, and created seed-to-sale configurations to ensure ITLs have the proper procedural requirements in their SOPs.
As to the first observation and recommendation, the Commission has enacted changes. In 2021, the Commission staff worked with its vendor, Metrc, to modify the seed-to-sale system to ensure that untested product cannot go to retail. As part of this process, the Commission required contaminant limits be embedded into Metrc to prevent an ITL from entering values outside of the contaminant thresholds while still passing the product.
Additionally, the Commission requires lab test batches to be included in Metrc. A “lab test batch” is a categorized group of required test types/analytes [substances being analyzed] that are linked together with built-in dependencies. Test samples are created to require all test types/analytes to be tested and entered into Metrc to ensure public safety.
The creation of lab test batches enables the categorization of test types, which requires ITLs to enter results under specific test categories instead of being entered as individual tests. With this type of entry, all required tests are entered and passed before the test status changes to a “Test Pass” status for the product.
Changes to the testing requirements in Metrc:
- June 2021 implemented lab test batches to ensure all testing is complete.
- Embedded limits within Metrc to prohibit the ITLs from passing a product with test results outside of the contaminant limits.
- The creation of a Product Category Chart to ensure product test type requirements are easily identified.
- Licensees add results from remediated products into Metrc. Any retest that does not appear to be fully correct goes from Metrc to the Commission staff for review to determine if the retesting meets standards.
While we agree with the recommendations, the Commission disagrees with how the audit team comes to this finding, questions the numbers reported in the current draft, and respectfully requests that this finding be revised. The audit team based its numerical findings on a misinterpretation of the 72-hour reporting requirement.
The controlling date for the purposes of the 72-hour reporting requirement is the report date on the Certificate of Analysis (COA). The report date on the COA is the date the laboratory completed its internal quality assurance processes, any retesting, and approved the results. Using the report date on the COA is consistent with the International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) standard 17025:2017 that requires results be reviewed and authorized prior to release (Section 7.8.1.1).
The pesticide failure notification to the Massachusetts Department of Agricultural Resources (MDAR) is also based on the COA report date. . . .
Each of these instances [of late or missing reporting] were known to the Commission; in fact, a Commission investigator discovered some of the deficiencies during an onsite inspection. The resulting investigations produced actions against Licensees. One of the investigations resulted in a $350,000 fine for pesticide use before the audit was completed. The Commission’s controls—which includes its staff—worked. The Commission provided all failure notifications, testing results, and other reports to the audit team, including investigatory and enforcement documents that demonstrated the Commission’s knowledge and active investigation of the failures to report pesticides to the Commission.
The draft report references reporting required at the “possibility of pesticide contamination.” As a preliminary matter, the Commission recognizes that MDAR has primary jurisdiction over the use of pesticides in the Commonwealth and coordinates closely with MDAR to ensure that its licensees are not using pesticides unless they have been approved by MDAR. The Cannabis Control Commission and MDAR, for the purposes of investigation, agree that a pesticide is not detected until a laboratory issues a COA and that licensees are required to notify us within 72 hours of such. Using the report date on the COA is consistent with the International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) standard 17025:2017 which requires results be reviewed and authorized prior to release (Section 7.8.1.1).
Auditor’s Reply
We appreciate CCC for explaining its rationale for noncompliance with Section 15(a)(3) of Chapter 94G of the General Laws. Specifically, CCC indicates that it follows best practices set by the International Organization for Standardization and the International Electrotechnical Commission; however, this audit assessed whether CCC complied with the General Laws. We understand that, for testing purposes, we used the pesticide test date reported on the certificate of analysis as the starting point for the 72-hour reporting window. This date would be the first date on which the possibility of pesticide contamination was known to the ITL. As noted above, Section 15(a)(3) of Chapter 94G of the General Laws states, “An independent testing laboratory shall report any results indicating contamination to [CCC] within 72 hours of identification.” Further, 935 CMR 500.160(3) requires that MEs and ITLs have written policies that include “notifying the [CCC] within 72 hours of any laboratory testing results indicating that the contamination cannot be remediated.” Yet, in its response, CCC asserts that the Office of the State Auditor misinterpreted the 72-hour reporting requirement, claiming that the 72-hour reporting window does not begin until the ITL issues the certificate of analysis. We found that there was a delay of 1 to 13 days between the pesticide test date and the date the certificate of analysis was ultimately issued by the ITL and recorded in Metrc.
CCC’s response to this finding states that using the report date on the certificate of analysis is consistent with the International Organization for Standardization and International Electrotechnical Commission standard ISO/IEC 17025. However, when we requested this standard during the audit, CCC told us it could not provide a copy of it. Further, CCC did not tell us that it used this standard as guidance until after we presented this issue. Finally, if CCC plans to continue to use the report date on the certificate of analysis as the starting point for the 72-hour reporting window, this must be clearly stated in its regulations; otherwise, CCC will remain noncompliant with the General Laws.
In its response, CCC asserts that during the audit period, controls were in place and working as intended. We acknowledge that CCC may have been aware of these instances of late or missing reporting, but the instances were only detected by an inspection after the event had already occurred. We believe that CCC needs to strengthen its existing process by implementing additional preventative controls, which should be designed to prevent the event from occurring in the first place. Again, we reiterate our recommendation that CCC should use Metrc to create a report that would automatically send all positive pesticide test results to CCC’s Investigations and Enforcement Unit.
| Date published: | September 26, 2023 |
|---|