ASTM D8308-21

Standard Practice for Cannabis/Hemp Operation Compliance Audits

SIGNIFICANCE AND USE
4.1 Intended Use—This practice is intended for use by parties who either develop, plan, and conduct internal or external audits, or are interested in the audit process since they are the subject of compliance audits or they mandate such audits to occur.  
4.2 Audits—Audits are conducted by an auditor or audit body that is independent of the entity being audited. Individuals that conduct an assessment of an operation or product that they are directly involved with or have a vested interest in, is technically not an audit. These assessments might be a pre-audit or gap assessment. This practice can be used for these types of activities and the rigor of a true audit may not be as critical.  
4.3 Terms and Concepts—The definition of terms in Section 3 and the perspectives on scale, objectives, and types of audits in Annex A3 provide concepts that help clarify the different roles involved in an audit, the various elements of an audit, and how this practice applies to different situations. This practice is written in terms that accommodate audits for different objectives and sizes.  
4.4 Application—Compliance audits are used to identify gaps between some criteria and the actual operational conditions. Knowledge of gaps are used to assess various risks, guide corrective action, preventive action, root cause analysis, improvement efforts, prevent fines and penalties, or provide stakeholders an objective evaluation of an operation and its potential safety, financial, or other risks. A user of this practice should understand and adapt the audit concepts, process, and responsibilities in this practice to their specific organizational structure and situation.  
4.5 Audit Scale—The scale of an audit can range from an internal audit of a small single operation with fewer than ten employees to an external audit of a large corporation with facilities at multiple international locations. In either case, large or small, the principles in this practice shall be followed to produce...
SCOPE
1.1 Purpose—This practice identifies the minimum requirements for the planning, conduct, and reporting of compliance audits of a cannabis/hemp business. It provides information on terms, procedures, and responsibilities.  
1.2 Intent—The intent is to provide specific instruction needed to develop reliable audit programs and procedures that are used to conduct audits that produce credible, consistent, and objective evidence and findings related to compliance with one or more standards, regulations, policies, best practices, or quality specifications. This practice can be used internally for pre-audit assessments to identify and correct operational gaps.  
1.3 Organization—This practice is organized in the following manner:    
Section  
Scope  
1  
Referenced Documents  
2  
Terminology  
3  
Significance and Use  
4  
Audit Process Overview  
5  
Audit Programs  
6  
Audit Process  
7  
Record Management  
8  
Keywords  
9  
Roles and Responsibilities  
Annex A1  
Auditor Qualifications and Staffing  
Annex A2  
Scale, Objectives, and Perspectives of an Audit  
Annex A3  
Process Diagrams  
Annex A4  
1.4 Nothing in this practice shall preclude observance of federal, state, or local regulations which may be more restrictive or have different requirements.  
1.5 This standard does not purport to address all of the safety concerns, if any, associated with its use. It is the responsibility of the user of this standard to establish appropriate safety, health, and environmental practices and determine the applicability of regulatory limitations prior to use.  
1.6 This international standard was developed in accordance with internationally recognized principles on standardization established in the Decision on Principles for the Development of International Standards, Guides and Recommendations issued by the World Trade Organization Technical Barriers to Trade (TBT) Committee.

General Information

• Status: Published
• Publication Date: 14-Feb-2021
• ICS: 65.020.20 - Plant growing
• Technical Committee: D37 - Cannabis
• Drafting Committee: D37.02 - Quality Management Systems

Standards Content (Sample)

This international standard was developed in accordance with internationally recognized principles on standardization established in the Decision on Principles for the
Development of International Standards, Guides and Recommendations issued by the World Trade Organization Technical Barriers to Trade (TBT) Committee.
Designation: D8308 − 21
Standard Practice for
1
Cannabis/Hemp Operation Compliance Audits
This standard is issued under the fixed designation D8308; the number immediately following the designation indicates the year of
original adoption or, in the case of revision, the year of last revision. A number in parentheses indicates the year of last reapproval. A
superscript epsilon (´) indicates an editorial change since the last revision or reapproval.
1. Scope Development of International Standards, Guides and Recom-
mendations issued by the World Trade Organization Technical
1.1 Purpose—This practice identifies the minimum require-
Barriers to Trade (TBT) Committee.
ments for the planning, conduct, and reporting of compliance
audits of a cannabis/hemp business. It provides information on
2. Referenced Documents
terms, procedures, and responsibilities.
2
2.1 ASTM Standards:
1.2 Intent—The intent is to provide specific instruction
D8229 Guide for Corrective Action and Preventive Action
needed to develop reliable audit programs and procedures that
(CAPA) for the Cannabis Industry
are used to conduct audits that produce credible, consistent,
and objective evidence and findings related to compliance with 3. Terminology
one or more standards, regulations, policies, best practices, or
3.1 Definitions of Terms Specific to This Standard:
quality specifications. This practice can be used internally for
3.1.1 action plan, n—a plan to correct negative audit find-
pre-audit assessments to identify and correct operational gaps.
ings and close gaps.
1.3 Organization—This practice is organized in the follow-
3.1.2 audit, v—see compliance audit.
ing manner:
3.1.3 audit authority, n—the entity that authorizes, or
Section
initiates, the audit process.
Scope 1
3.1.3.1 Discussion—The audit authority may be internal to
Referenced Documents 2
Terminology 3
the audited entity, such as senior management not involved
Significance and Use 4
with the day-to-day operations of the operation/area(s) being
Audit Process Overview 5
audited; or external, such as a financial stakeholder, a business
Audit Programs 6
Audit Process 7
customer, or a government authority having jurisdiction.
Record Management 8
3.1.4 audit criteria, n—the set of requirements that are
Keywords 9
Roles and Responsibilities Annex A1
applicable to the objective and scope of an audit. Examples
Auditor Qualifications and Staffing Annex A2
include standards, regulations, laws, policies, best practices,
Scale, Objectives, and Perspectives of an Audit Annex A3
quality specifications, and industry best practices.
Process Diagrams Annex A4
1.4 Nothing in this practice shall preclude observance of 3.1.5 audit data, n—data collected during an audit to sup-
federal, state, or local regulations which may be more restric- port the audit findings. Examples: Photos, notes, documents,
tive or have different requirements. records, forms, and answers.
1.5 This standard does not purport to address all of the 3.1.6 audit finding, n—a statement of the audited entity’s
safety concerns, if any, associated with its use. It is the conformity against the audit criteria at the time of the audit.
responsibility of the user of this standard to establish appro- 3.1.6.1 Discussion—The audit finding is the good/bad,
priate safety, health, and environmental practices and deter- conformity/nonconformity statement that results from an
mine the applicability of regulatory limitations prior to use. evaluation of the audit data collected. It can also be the
1.6 This international standard was developed in accor-
collective conformity/nonconformity of each question or crite-
dance with internationally recognized principles on standard- ria. The audit finding(s) is not the audit data that supports the
ization established in the Decision on Principles for the
audit finding.
3.1.7 audit objective(s), n—broad statement(s) of what the
audit intends to accomplish.
1
This practice is under the jurisdiction of ASTM Committee D37 on Cannabis
and is the direct responsibility of Subcommittee D37.02 on Quality Management
2
Systems. For referenced ASTM standards, visit the ASTM website, www.astm.org, or
Current edition approved Feb. 15, 2021. Published March 2021. Originally contact ASTM Customer Service at [e-mail]. For Annual Book of ASTM
approved in 2020. Last previous edition approved in 2020 as D8308 – 20. DOI: Standards volume information, refer to the standard’s Document Summary page on
10.1520/D8308-21. the ASTM website.
Copyright © ASTM International, 100 Barr Harbor Drive, PO Box C700, West Conshohocken, PA 19428-2959. United States
1

---------------------- Page: 1 ----------------------
D8308 − 21
3.
...

This document is not an ASTM standard and is intended only to provide the user of an ASTM standard an indication of what changes have been made to the previous version. Because
it may not be technically possible to adequately depict all changes accurately, ASTM recommends that users consult prior editions as appropriate. In all cases only the current version
of the standard as published by ASTM is to be considered the official document.
Designation: D8308 − 20 D8308 − 21
Standard Practice for
1
Cannabis/Hemp Operation Compliance Audits
This standard is issued under the fixed designation D8308; the number immediately following the designation indicates the year of
original adoption or, in the case of revision, the year of last revision. A number in parentheses indicates the year of last reapproval. A
superscript epsilon (´) indicates an editorial change since the last revision or reapproval.
1. Scope
1.1 Purpose—This practice identifies the minimum requirements for the planning, conduct, and reporting of compliance audits of
a cannabis/hemp business. It provides information on terms, procedures, and responsibilities.
1.2 Intent—The intent is to provide specific instruction needed to develop reliable audit programs and procedures that are used
to conduct audits that produce credible, consistent, and objective evidence and findings related to compliance with one or more
standards, regulations, policies, best practices, or quality specifications. This practice can be used internally for pre-audit
assessments to identify and correct operational gaps.
1.3 Organization—This practice is organized in the following manner:
Section
Scope 1
Referenced Documents 2
Terminology 3
Significance and Use 4
Audit Process Overview 5
Audit Programs 6
Audit Process 7
Record Management 8
Keywords 9
Roles and Responsibilities Annex A1
Auditor Qualifications and Staffing Annex A2
Scale, Objectives, and Perspectives of an Audit Annex A3
Process Diagrams Annex A4
1.4 Nothing in this practice shall preclude observance of federal, state, or local regulations which may be more restrictive or have
different requirements.
1.5 This standard does not purport to address all of the safety concerns, if any, associated with its use. It is the responsibility
of the user of this standard to establish appropriate safety, health, and environmental practices and determine the applicability of
regulatory limitations prior to use.
1.6 This international standard was developed in accordance with internationally recognized principles on standardization
established in the Decision on Principles for the Development of International Standards, Guides and Recommendations issued
by the World Trade Organization Technical Barriers to Trade (TBT) Committee.
1
This practice is under the jurisdiction of ASTM Committee D37 on Cannabis and is the direct responsibility of Subcommittee D37.02 on Quality Management Systems.
Current edition approved Jan. 15, 2020Feb. 15, 2021. Published February 2020March 2021. Originally approved in 2020. Last previous edition approved in 2020 as D8308
– 20. DOI: 10.1520/D8308-20.10.1520/D8308-21.
Copyright © ASTM International, 100 Barr Harbor Drive, PO Box C700, West Conshohocken, PA 19428-2959. United States
1

---------------------- Page: 1 ----------------------
D8308 − 21
2. Referenced Documents
2
2.1 ASTM Standards:
D8229 Guide for Corrective Action and Preventive Action (CAPA) for the Cannabis Industry
3. Terminology
3.1 Definitions of Terms Specific to This Standard:
3.1.1 action plan, n—a plan to correct negative audit findings and close compliance gaps.
3.1.2 audit, v—see compliance audit.
3.1.3 audit authority, n—the entity that authorizes, or initiates, the audit process.
3.1.3.1 Discussion—
The audit authority may be internal to the audited entity, such as a department manager, a CEO, or the board of directors, senior
management not involved with the day-to-day operations of the operation/area(s) being audited; or external, such as a financial
stakeholder, a business customer, or a government authority having jurisdiction.
3.1.4 audit criteria, n—the set of requirements that are applicable to the objective and scope of an audit. Examples include
standards, regulations, laws, policies, best practices, quality specifications, and industry best practices.
3.1.5 audit data, n—data collected during an audit to support the audit findings. Examples: Photos, notes, documents, records,
forms, and answers.
3.1.6 audit finding, n—a statement of the audited entity’s conformity against the audit criteria at the time of the audit.
3.1.6.1 Discussion—
The audit finding is the good/bad, conformity/nonconformity statement that results from an evaluation of the audit data collected.
It can also be the collective conformity/nonconformity of each question or criteria. The audit finding(s) is not the audit data that
supports the audit finding.
3.1.7 audit objective(s), n—broad statement(s) of what the audit intends to accomplish.
3.1.8 audit plan, n—docum
...