Compliance, licensing and track-and-traceCompliance, licensing and track-and-trace

Purpose and scope

Plant growth is one half of the task. The other half is to show facts to a person who was not there. You must show, on paper and at all times, where each gram came from and where it went. You must also show that you obeyed the written procedures of your facility. This paper is about the system of records that shows these facts.

This paper is for a person who has new compliance tasks and also applies water to the plants. Examples are an operator with a first license and a small group of personnel in which the head grower is also the quality manager. A technician who speaks with an auditor for the first time can also use this paper. It is not necessary to know compliance before you read this paper. This paper gives information about each term before it uses the term.

This paper shows the license and its life. It shows the communication between your facility and the regulator. It shows batches and lots, and the genealogy that connects all records. It shows seed-to-sale traceability and the regular reconciliation of the inventory. It shows records that an auditor accepts. It shows how to record deviations with a minimum of documents.

It gives information about the boundary between GACP and GMP, and about quality agreements. It shows security and destruction. It shows how to prepare for a recall. It shows the steps of an audit day. At the end, there are two worked examples in general terms, from New Zealand and Australia.

Definitions

When two persons use the same term for different items, a problem occurs in the compliance work. These definitions are general. The definitions in the regulations of your regime are more important than these definitions. When you start a facility, one task is to write the definitions that you use.

Evidence and limitations

Primary task of compliance: control with records

Each regulation in each cannabis regime tells you to do one primary task: show control. Control of the material is the first part. Material comes into the facility, moves in the facility and moves out of the facility only when the records show it. Control of the work is the second part. The work on the plant obeys written procedures. The records must show this control to a person who was not there and who accepts only the records.

Most new operators give too much work to layer one, the license. They do not give sufficient work to layer three, the records. This method is incorrect. A regulator does not usually remove a license on the day that it gives the license. The regulator removes it after some years, in layer three, when an auditor wants a basic fact that the documents cannot show.

In GMP for medicines, documents are not a secondary task. The quality system includes the documents^[1]. Cannabis regimes use the same structure.

License activities, conditions and renewals

A cannabis license is not one approval. It is a group of activities with names. The activities have conditions. For example, the regime of New Zealand makes each license from some of these activities: cultivation, nursery (the supply of seeds and propagation material), research, possession for manufacture, and supply^[2].

In December 2021, Australia changed its Commonwealth structure to one medicinal cannabis license. This license can include cultivation, production, manufacture and research, with permits in the limits of the license^[3]. The names are different in the two regimes. The structure is the same in almost all regimes: activities plus conditions plus quantities.

Read your license as a system with these parts:

Two methods prevent most problems with a license. The first method is a compliance calendar. The compliance calendar has each end date, each renewal period, each date for a report and each fee. Set alerts for 90, 60 and 30 days before each date. A renewal is an easy task. If you do not make the renewal on time, the operation stops.

The second method is to make variations before the change, not documents after the change. If you want to add a room, an activity or a key person, the general instruction is the same in all regimes. Get the approval of the regulator first. Then do the change. Operators who do this incorrectly usually know the instruction. They think that no person will find the error.

Inspections, notifications and variations

The regulator is not a customer. The regulator is not against you. The regulator is external quality assurance with the authority of the regulations. The task of the regulator is to make sure that you have control. Each item that the regulator wants to examine is for this task.

In New Zealand, this function is in a dedicated agency in the Ministry of Health. The agency operates the scheme and its licensing^[5]. In Australia, the function is in the Office of Drug Control at the Commonwealth level^[4]. In all regimes, there are three types of communication between you and the regulator:

Your communication with the inspector during an inspection is more important than most operators think. Do not tell the inspector during the inspection that a finding is incorrect. If you think that a finding is incorrect, write to the regulator after the inspection. Give records that show the facts. Write notes of all the information that the inspector tells you.

Make sure that you can correct each finding. If a finding is too general, tell the inspector and continue until you can correct it. Write to the regulator before the date that the regulator gives. Give a date for each task that you will do. Then do the tasks.

A finding that occurs again at the next inspection is worse than the first finding, because it shows if your system corrects its errors. Regulators want to know this fact most of all.

Batch and lot traceability

A batch is a specified quantity of material that comes from the same procedure at the same time. Thus the material is the same in all parts. One test result, one record and one decision are then correct for all of the batch. Traceability is correct only when each batch is the same in all parts.

In a grow room, plants that you start together and that get the same treatment are a batch. When the treatment is different, you have two batches. Examples are a different room, a different feed, or a spray on some plants and not on other plants. You have two batches also if you do not record the difference. Make the documents agree with the plants, and not the plants with the documents.

GMP quality systems give a careful definition of batch and lot. In these systems, the traceability must include all material that goes into each batch^[6]. Small operators frequently have problems not because their definitions of batches are incorrect, but because they put batches together and divide batches without a record.

Thus the records of one plant are important. In the genealogy, each record is also part of the records of all the batches and lots that follow it. The spray on the mother plant is part of the pesticide records of the package lot, four steps after the mother plant. A CoA for a package lot shows the facts about the lot only if the sequence before it has no gap.

The opposite is also correct. A missing record causes a problem for all the material after it, because you cannot show that an event did not occur. If the spray log has a gap of three weeks, you cannot show that you did not spray that crop.

• Make IDs that a person can read and that are different for each batch. An example is the ID CL-2603 (clones, week 26, batch number 2003). This ID is better than ‘the back table’ and better than a UUID. You can use a different system for IDs. Write your system for IDs in your documents.
• To divide a batch, or to put batches together, is an event. If you put two harvest lots together in one dry lot, record the change. Record the weight before the change and the weight after the change. Do not do it without a record.
• Do not let material stay without an ID, also for a short time. Containers of wet trim with no label are where traceability stops.

Seed-to-sale traceability and reconciliation

Track-and-trace is a continuous inventory system for a controlled substance. It has three parts: identification, events and a ledger. Each plant and each package has an identification, which is a tag or a UID. You record each event when it occurs. The events are each movement, each change of the material, each sample and each destruction.

The ledger contains all of the records. The ledger can be a system that the regulator tells you to use, commercial software, or a paper logbook. The method is the same for all of them.

The US state model is a good worked example. Some systems, for example METRC, give tags for plants and tags for packages. Licensees record growth stages, harvests, changes of the material, transfers and destructions with these IDs, in the time periods that the system gives^[7]. In California, each licensee with a commercial license must record all cannabis activity, from cultivation to sale, in the track-and-trace system of the state, CCTT-Metrc. The system uses an identification that is different for each plant and package^[8].

In New Zealand and Australia (in 2026), there is no ledger of this type that the state operates. The same functions are in your records and in the reports that you send to the regulator. The software is different in each regime. The terms and the structure are the same for all regimes.

These methods are correct for all software:

• The stock in the room must be equal to the ledger. The room and the ledger must show the same facts at all times. A gap between them, in each direction, is a finding.
• Record each event when it occurs, at the location where it occurs. If you record the movements of the day at 5 pm, and you did not record them when they occurred, you cause drift.
• Weigh the material at each change. Record the wet weight at harvest and the dry weight after drying. Record the weight of waste at trim and the net weight at packaging. The differences show the quantity of moisture and the quantity of waste. Auditors examine these differences carefully.
• Material goes from the facility only as a recorded transfer, a recorded sample or a recorded destruction. There is no fourth type. ‘I gave some to the person at the laboratory’ is a sample with an entry in the log, or it is diversion.
• Write the manifest before the material moves. The manifest gives the material, the quantity, who sends it, who receives it and the carrier. When the material comes to the site that receives it, the two sites compare the material with the manifest.

Inventory reconciliation and drift

Inventory reconciliation is an audit test. Each person can do the test and read the result. The ledger shows one quantity, the scales show a different quantity, and you must find the cause of the difference. Thus a variance with no known cause is a primary cause of an unsatisfactory audit for a small operator. The test is very easy to do, and falsification of the result after the event is not easy.

The causes of drift are not unusual. One cause is that the moisture in the flower decreases during curing and no person records the change of moisture. A second cause is that personnel put trim in the bin and do not record the weight. A third cause is that QC samples and laboratory samples do not go into the ledger. A fourth cause is that personnel record the wet weight in one unit and the dry weight in a different unit. A fifth cause is that, on the harvest day, material moves between rooms faster than personnel write the movements.

No cause in this list is diversion. In the records, diversion and each cause in this list show the same data. In a regime for controlled substances, missing material with no known cause is possible diversion, until you show that it is not. When the state auditors of Oregon examined their system for recreational cannabis, they found two primary problems when the system must find diversion. The system uses data from reports that the operators write, and the quality of the data in the track-and-trace system is unsatisfactory^[9].

The correction is a regular schedule and correct records. Count one area each week and count the full inventory each month. Write an investigation for each variance on the day that you find it. Do this also if the result is: ‘The moisture decreased in the typical range. We changed the typical value.’ Give the ledger one owner.

Also write the value that you use for the change of moisture. For example, you can write that the weight decreases by 75–80% from the wet weight to the dry weight. Then the largest change of weight with a known cause is not a gap in your records.

Records for an audit and ALCOA+

Regulators in all countries use the same definition of a good record. The usual name of this definition is ALCOA. The properties are Attributable, Legible, Contemporaneous, Original and Accurate. Personnel also add Complete, Consistent, Enduring and Available (ALCOA+). The US FDA uses these properties in its document about data integrity for the manufacture of medicines^[10]. Cannabis auditors use the same structure without a change.

These methods are for a small facility:

• Use a logbook with a number on each sheet, or a digital system that records each change. Loose sheets of paper, and spreadsheets that a person can change without a record, make an auditor think that you changed the records.
• Write in the work area, not in a different room. A log that hangs in the work area is better than good software in a different room. It makes the correct procedure the easiest procedure.
• To correct an entry: make a strike-through with one line, write your initials, the date and the cause. You can read the incorrect value below the strike-through. Do not use a pencil or correction fluid. Do not remove sheets from the logbook. Do not put a copy of records with errors in a new logbook. The first record with the errors is the record.
• Do not keep a field empty. Make a strike-through on each field that does not apply. An auditor can think of the worst cause for an empty field.
• Keep records for years, not for months. The minimum period is different in each regime. It is usually in the conditions of your license. The storage of records must continue to be available when personnel change and when a device does not operate.

The property Contemporaneous causes the most problems. The cause is that a backfilled record shows signs. An example is a week of entries that one person wrote with one pen, in one handwriting and at one time. The sheets are clean and the times are all round numbers. A second example is a digital log in which twenty entries have almost the same system time on the night before the inspection.

Auditors use the methods of forensic document examination when they examine logbooks. If an auditor finds a backfilled record, the result is worse than for a gap that you tell the auditor about. A gap causes one finding. A backfilled record causes the auditor to reject all your other records.

Deviations and corrective actions

A deviation is each difference between your work and your written procedure. Some examples: the dehumidifier stopped in the night, or the feed mixture had an incorrect EC. Other examples: personnel sprayed the incorrect room, or a supply of material came with no documents. The deviation is not the primary problem. The primary problem is a deviation that you did not record, because then your system does not find its deviations. To find deviations is the primary task of a quality system^[6].

Set the depth of the record for the size of the deviation. A check that you did not do on one day gets a record of three lines, and you complete it on the same day. A feed from the incorrect tank that touched two flowering batches gets a check of the effect on the product, and a root cause.

In your procedure, give each deviation a type: small, important or very important. Then the procedure gives the depth of the record. The depth does not change with the decision of a person at that time. An auditor does not want a facility with no deviations. The auditor wants records that show that you find deviations, examine the effect on the product and complete the loops.

GACP, GMP and quality agreements

Two systems apply from seed to medicine. GACP (Good Agricultural and Collection Practice) is for the cultivation, harvest and primary processing of plants for medicine. It includes the identification of the plant, hygiene, the materials that you apply to the plants, documents, and traceability at the cultivation site. The primary document is the guideline of the WHO of 2003^[11].

The European medicines regulator has a GACP guideline for herbal starting materials. In 2025, the regulator changed this guideline. The new guideline includes cultivation in a room with a controlled environment^[12].

GMP (Good Manufacturing Practice) is for the change of this material into a medicine. It includes validated processes, batch manufacturing records, QC release, and a quality unit that operates independently^[1]. The PIC/S GMP guide aligns the GMP procedures of the inspection authorities of many countries. These include the authorities of New Zealand and Australia^[6].

The position of the boundary is different in each regime, and it is important for your business. Cultivation, drying and trimming are usually in GACP. Extraction, formulation and packaging of the medicine are in GMP. For example, the TGA of Australia uses GMP for the manufacture of the product. Cannabis cultivation supplies starting material, and GACP is the system for it. A mandatory quality standard, TGO 93, sets the product quality^[13].

In 2026, examine the information from your regulator about the position of the boundary. The position of the boundary gives the system for your dry room. An error in each direction has a high cost.

For a grower, the result of the boundary is that you are a supplier of starting material to a GMP site. GMP tells that site to do a qualification of each supplier. Auditors of the processor, and auditors of the regulator, can examine your facility. Your GACP documents (genealogy, records of the materials that you apply, drying logs and CoAs) show to the processor that you control the starting material.

The quality agreement is the document for this. It divides the quality tasks between the two parties, with the signature of each party. Thus no task is missing because each party thinks that the other party has the task.

Security, access and destruction records

Each regime gives its security instructions in the conditions of the license. Examples are safes, the type of alarm, and the number of days that you keep the camera records. Thus this section gives only general information. The same fact is correct in all regimes: controlled material must stay in controlled custody. You show custody with records, and you show all other facts with records.

• Use layers, not one large lock. The layers are the site, the building, the room and the container. Each layer decreases the speed of an intruder, and decreases the number of persons who have approval to be in it.
• Access has two lists. The first list shows who has approval to go in. It is a list of approvals that you keep and sign. The second list shows who did go in. It has the entry logs, the logbooks of keys and codes, and the visitor logbook with the name of the escort. Auditors compare the two lists.
• Personnel who start and personnel who stop work at the facility. The usual finding is a code of a person who stopped work at the facility, and the code continues to operate some months after. When a person stops work at the facility, do these tasks on the same day. Cancel the codes, collect the keys and change the lists. Make a record.
• Each visitor must have an escort, and you must record each visitor. Contractors are also visitors. An electrician in the flower room is in your chain of custody while the door is open.

Waste is also controlled material. Waste includes trim, fan leaves from flowering plants, rejected lots, and plants with no life. In most regimes, cannabis waste stays in the custody of the licensee until you destroy it and record the destruction. The bin is not an exit from track-and-trace. The destruction is an event, and a transfer is also an event.

How to prepare for a recall, and mock recalls

A recall is traceability in an emergency. Material that went from the facility can be defective, and you must find all of it quickly. You must also show that you found all of it. A GMP system must have a recall procedure, and personnel must do a test of the procedure^[6]. The smallest grower with a license can use the same method. The task is the same at all sizes: you must find where each gram of that lot went.

To prepare for a recall, you must use the genealogy in the two directions. Trace back from a product in the market to each material, room, person and procedure that touched it. Trace forward from a possible source of the problem to each lot and each customer that received material from it. The source can be one mother plant, one supply of nutrients, or one dry room. We recommend that you use only records for the two directions, and that you do it in hours.

The mock recall is the test of the recall procedure. Select a lot randomly. Simulate an unsatisfactory test result for the lot. Do all the steps of the recall on paper, and measure the time. No material moves. The output is a report with the time.

In many quality schemes for supply chains, the usual target is a reconciliation of almost all of the quantity on the same day. The time is hours, not weeks. Write your target in a document, and measure against it.

In most first tests, these problems occur. A transfer has no lot ID, and then the manifest cannot show which lot the processor received. A retained sample is in the SOP, but is not on the shelf. The weight of waste is not accurate, and then you cannot complete the mass balance. Each problem is easy to correct on a usual day, at a low cost. It is very bad to find the problem during a recall that is not a test.

The steps of an audit day

Inspections are different. An inspection can be with or without a notification. It can be a document inspection or an on-site inspection. It can be usual or because of a trigger.

The structure of a good audit day is always the same. You complete 90% of the work before the inspector comes. The audit day follows a sequence of steps.

1. 1
   Notification received

   Write to the regulator. Make sure that you know the areas, the date, the time and the persons who will come. Tell your key persons the date. If the regulations tell a responsible person to be at the inspection, make sure that the person is there.
2. 2
   Inspection before the audit

   Examine your facility against your SOP index and the conditions of your license. Correct each problem that you can correct, and record the facts. Do not backfill records. A gap that the auditor finds is one finding. A backfilled record that the auditor finds is a large problem.
3. 3
   Prepare the front room

   Prepare these documents: the license and its conditions, the chart of the personnel, the SOP index and the training records. Prepare the logs, the findings of the last inspection and the records that show how you completed them. Make sure that you can find each document in minutes.
4. 4
   Opening meeting

   Make sure that you and the inspector have the same information about the areas, the time and the sequence. Select one person for all communication with the inspector. This person records each document that you give to the inspector. All other personnel tell the inspector only the facts that the inspector wants. They do not tell facts that they do not know.
5. 5
   The walk

   The inspectors monitor your work and compare it with the procedures. They examine gowning, logs in the work area, labels on containers, and locks that operate. Tell only the facts that you know. If you are not sure, tell the inspector: ‘I will examine this and write to you.’ Write the task in your notes. Do not tell the inspector that the inspector is incorrect.
6. 6
   The document room

   Record each document that the inspector wants. Identify each copy as a copy. Keep the initial documents. If there is no record, tell the inspector. Tell the inspector how you will correct the gap. The correction is more important than the gap.
7. 7
   Closing meeting

   Write each finding with the information that the inspector gives. Make sure that you know each finding. If a finding is too general, tell the inspector and continue until you can correct it. Do not tell the inspector at this time that a finding is incorrect. If you think that a finding is incorrect, write to the regulator after the inspection. Give records that show the facts.
8. 8
   The report to the regulator

   Write to the regulator before the date that the regulator gives. For each finding, give the corrective action, the preventive action, the date and the owner. Then do these tasks and keep the records that show them. The next audit starts with these records.

The usual problems of small operators

Operators usually do not want to cause damage. Operators do not frequently have problems because they do not know cultivation. The problems occur again and again, and they come from the structure of the facility. You can find each problem before it occurs:

Worked examples: NZ and Australia

New Zealand, the Medicinal Cannabis Scheme

The Medicinal Cannabis Agency, in the Ministry of Health, operates the scheme of New Zealand. The regulations for the scheme are the Misuse of Drugs (Medicinal Cannabis) Regulations 2019. They started on 1 April 2020^[14]. The license has activities with names: cultivation, nursery, research, possession for manufacture and supply. An operator makes an application for the activities that the facility must have^[2].

A product must have a minimum quality standard before the operator supplies it. Thus cultivation records that obey GACP, and manufacture that obeys GMP, are important for an operator that wants to supply the market for medicines^[5]. A license has conditions for security, records and reports, and it has renewal cycles. The Agency gives the documents with information for the application, and the Agency does the inspections.

Australia, ODC licensing, TGA quality

Australia divides the task at the Commonwealth level. The Office of Drug Control gives licenses for cultivation, production, manufacture and research. The Narcotic Drugs Act 1967 gives the regulations for these licenses^[4]. Since 24 December 2021, one medicinal cannabis license can include these activities, with permits for quantities in the limits of the license^[3].

The product quality is the task of the Therapeutic Goods Administration. GMP is the system for manufacture. Cultivation supplies starting material, and GACP is the system for it. Medicinal cannabis products that you supply in Australia must obey a mandatory quality standard, TGO 93^[13]. The regulations of the states and territories add more layers to the Commonwealth regulations.

The two regimes show the general structure of this paper. There is a license with activities and conditions. There are permits or controls of quantity in the limits of the license. There is a quality standard that makes GACP and GMP necessary for decisions about cultivation. Tasks for security, records and reports are conditions of the license. When you know this structure, you can read the documents of your regime with it.

• NZ Medicinal Cannabis Agency, about the scheme
• NZ, license activities
• NZ, Misuse of Drugs (Medicinal Cannabis) Regulations 2019
• AU Office of Drug Control, medicinal cannabis
• AU TGA, quality standard for medicinal cannabis

Troubleshooting and the basic facts of control

Read these papers next. The paper Daily checks goes with this paper. It shows how to make the set of records for each day. This set decreases the cost of all the work in this paper.

The paper about GMP hash manufacturing gives information about the work on the GMP side of the boundary. There your lots become the starting material of a different party. The IPM papers show that the spray log that you keep for compliance also helps to prevent damage to your crop.