By Ellice Ogel, Tyler Williams, Peter Dougherty, David Vaillencourt, Trevor Morones
NCIA’s Cannabis Manufacturing Committee

A Primer on current Good Manufacturing Practices

What are GMPs?

Good Manufacturing Practices (GMP) are minimum requirements to ensure that products are created in a manner that ensures they are of consistent quality and safe for their intended use. If a product is found to be produced in a facility that does not meet GMPs, they can be considered adulterated and unsafe. In the U.S., the U.S. Food & Drug Administration (FDA) regulates the manufacture and sale of food and beverages, dietary supplements, pharmaceutical products, and cosmetics by requiring adherence to GMPs. The “c” in cGMP stands for current, meaning that how companies conform to GMPs must continually evolve with the development of new scientific research and industry best practices. Today, the two terms are used interchangeably. While cannabis is not recognized as a legal product at the federal level, federal legalization will inevitably result in the requirement for cannabis producers to conform to cGMPs. 

cGMPs can be broken into six major sections (1) Management Commitment, (2) Risk Management, (3) Quality Management Systems, (4) Site & Facility Management, (5) Product Controls, and (6) Staff Training (Figure 1).

Why are cGMPs important?

cGMPs are important for every industry to ensure manufacturers are producing safe products. A site that isn’t following the minimum requirements for cGMPs in their specific industry is putting the basic well-being of consumers around the world at risk, which the FDA terms adulterated. cGMPs provide assurance that steps within the manufacturing process result in passing final product testing. Final product testing alone is not enough to ensure the safety of consumers. In most cases, final product testing is completed on a small sample batch, so that manufacturers are not wasting the final product on sampling and testing. For example, if the manufacturer is producing 1 million dietary supplements, the manufacturer might only test 100 tablets from that batch. This means that if cGMPs are not being followed and there is no consistency in the safety of producing that product, then some of the products may be safe for consumption, while others may not. This results in product recalls or withdrawals, damage to brand reputation, and lawsuits. A recent study by the Denver Department of Health found that 80% of cannabis products on dispensary shelves failed testing despite passing final batch testing prior to sale.

What do cGMPs include?

Every industry regulated by the FDA has its own guidelines for cGMPs, which are found within Title 21 of the Code of Federal Regulations. Unique differences between cGMP requirements for each industry exist. If your company has multiple product lines that fall into any of these different industries, understanding how these differences will impact you are critical. Figure 2 provides a high-level overview of the major GMP topics that are required by industry.

Figure 3 Table of the major industry types regulated by the FDA and where one can find the major cGMP requirements

Not all GMP topics are referenced in the primary section of the CFRs, which can make it difficult for people who are new to GMPs to ensure they are appropriately prepared. For example, the food and beverage cGMPs (21 CFR 117) does not include packaging and labeling controls, whereas the pharmaceutical cGMPs (21 CFR 211) does include packaging and labeling controls. 21 CFR 101 is home to packaging and labeling statues for the food and beverage industry. 

Each sector regulated by the FDA has overlap which contributes to talent acquisition/recruitment from other industries. 

THIRD-PARTY cGMP AUDITS

What are Third-Party cGMP Audits?

A third-party cGMP audit is a systematic independent and documented activity in which objective evidence is gathered and assessed to determine if the site’s cGMP system is appropriate and effective. In the 1990’s third-party GMP audits were like an inspection you would receive from the FDA or local health department. This means there was a heavy focus on the building itself and what was happening on the production line during the time of the audit. Nowadays, cGMP audits typically include much more than what is required from the Code of Federal Regulations (CFR). Examples of this include extra requirements for Hazard Analysis Critical Control Points (HACCP) and a much heavier review of documentation to ensure best practices are being followed all the time and not just on the audit day.

Benefits of Using an Experienced and Accredited Certification Body

One thing to keep in mind when considering a third-party cGMP audit is whether or not the audit is accredited. Certification Bodies are accredited (approved) by an Accreditation Body, to ensure their internal procedures and audit processes follow strict guidelines for different audit standards. If approved, the CB gets accredited to that specific audit standard. This along with direct oversight of the audit Scheme Owner and the Accreditation Body ensure that the Certification Body has qualified auditors and that the entire audit process goes through several quality checks before it becomes “final.” In the U.S., the three major accreditation bodies approved to do this are:

1. American Association for Laboratory Accreditation  
2. ANSI National Accreditation Board (ANAB) 
3. International Accreditation Service (IAS)  

For more information on this process, one should refer to the International Accreditation Forum (www.iaf.nu).

WHY SHOULD MY COMPANY RECEIVE A 3rd PARTY cGMP AUDIT?

Unlike the food & beverage, dietary supplement, pharmaceutical, and cosmetics industries, cannabis is federally illegal in the United States. This means there are no federal regulations for cGMPs in the cannabis industry. However, some states, such as Florida, have taken the initiative and implemented requirements to have all cannabis facilities become audited to a cGMP standard before they can receive their license to begin manufacturing.

As the cannabis industry continues to evolve, retailers and others downstream in the supply chain will demand that cannabis manufacturers provide evidence of a certain level of quality and safety in their products. An attestation or certificate from a third-party demonstrating that your facility meets cGMP requirements is an internationally recognized way to provide that evidence and establish trust. Globally, third-party cGMP audits are crucial to maintaining product safety and quality by providing a third set of eyes to verify what is working and what is not. Besides regulatory requirements and customers requiring your facility to get a third-party cGMP audit, there are numerous other benefits to receiving a cGMP audit. Some of these benefits include the following:

• Reduction in failed product testing
• Improvement of product safety
• Improvement of product quality and consistency
• Eliminating potential risks and possible recalls
• Marketing advantages over competitors who are not audited by a third-party
• Improvement to consumer confidence and an increase in brand loyalty

ROADMAP TO cGMP CERTIFICATION

Management Commitment

It is essential to the entire cGMP system to have commitment from top-down. Without this, your site will not receive the resources (e.g. people, equipment, tools, budgets) it needs to implement an effective cGMP system. The culture of an organization requires everyone to practice what is lectured. Simply; Say what you do, do what you say. 

Start Preparing Early

Be realistically courteous to the timeline by generating an internal analysis. Using the scheme, the audit will be against, create a list of programs you currently have, and which are missing. Working towards a better score early will provide greater long-term value. 

The very first thing you need to do before you start making major changes to your facility or procedures is to identify which GMP standard or standards you intend to meet. With this established, you can select a Certification Body and obtain a copy of the audit form or checklist that they will use to assess you. 

Assess Your Current Level of Conformance

Establish an audit team and conduct a thorough assessment of your current organization. If this is new to your organization and staff, it is beneficial to work with a GMP expert that has experience in both cannabis and the cGMP program you are going to be audited against. Review your entire system against the audit checklist and highlight or markup items your site is already doing. This allows you to focus on the things you are missing and close any “gaps”.

Implementation and Teamwork

The preparation of an audit should never rest on the shoulders of one person. Your site should establish a multidisciplinary/interdepartmental team to implement the various tasks based on the findings from your initial assessment. Collaboration is key to successfully preparing for a cGMP audit, especially when timelines set by upper management are very stringent.

Training

Training is essential in preparing for your cGMP audit and business in general. This helps close the gaps between what your safety and quality department has developed and what your front-line employees are applying. All employees should understand what cGMPs are and how it applies to and benefits their daily activities.

Establish Your Internal Audit Program

Conducting internal audits is an effective way to not only prepare for your cGMP audit but to continually improve your organization. Breaking down your entire audit checklist into department or process-specific sections, you can establish the frequency of auditing these bite-sized sections. Should they be reviewed annually, semiannually, quarterly, monthly, or continuously throughout day-to-day operations? Some things, like reviewing your suppliers, may only need to be done annually, while things such as pre-operational inspections should be performed daily. Always use the actual audit checklist to observe your documents and facility to see if there are any gaps. Whenever possible, the person or team conducting the internal audit should never review their own work. Establishing any issues or non-conformances should be noted, evaluated, corrected, and closed out.

Schedule Your Third-Party Audit

A third-party mock audit is the closest thing you can get to an actual audit. This is where a third-party company would come in and evaluate your site to the specific cGMP standards and give a formal report over any deficiencies found during the assessment. This is a great way to test your preparedness before the actual audit.

Address Non-Conformances and Celebrate!

Your auditor will almost certainly identify areas where you are not fully compliant, known as non-conformances. Depending on your level of preparedness, you will hopefully have only a few Minors, but non-conformances can be classified as Major or Critical. You will work with your auditor to establish actions and a timeline to effectively resolve these non-conformances and provide follow up evidence of their closure. After successfully closing out your non-conformances, you will be rewarded with a certificate or attestation. Sit back, relax, celebrate! With a cGMP system in place, the established intervals to audit your system will ensure you have the tools and knowledge to maintain your cGMP status!