D37.02 - Quality Management Systems

SIGNIFICANCE AND USE
4.1 This practice is intended to be used by cannabis or hemp operators, or both, to establish good supplier lifecycle management practices.  
4.1.1 Without proper oversight, the quality and reliability of supplied materials, equipment, parts, software, or services can degrade. This can create issues that directly impact the operation's performance and remain undetected until customers experience a problem.  
4.1.2 Early identification and mitigation of risks within the supply chain are crucial to controlling costs and minimizing potential impacts on operations, customer experience, and business reputation. In general, costs are reduced when issues are prevented early and upstream in the supply chain.  
4.2 This practice applies to the cannabis or hemp horticulture, agriculture, processing, manufacturing, testing, and distribution operators and the many suppliers that provide materials, equipment, parts, software, or services to these operations.  
4.3 This practice provides operations and consultants supporting operations with the actions required to implement good supply and supplier management practices.  
4.4 Any supply chain operator can use this practice to conduct an internal gap assessment and risk analysis to identify opportunities for improvement.  
4.5 Certification bodies can use the standard to develop supplier audit programs.  
4.6 Section 5 provides details on the supplier lifecycle management process that includes the following seven activities:  
4.6.1 Supply and supplier information management.  
4.6.2 Supply identification and specifications.  
4.6.3 Supplier options, evaluation, and selection.  
4.6.4 Supplier onboarding.  
4.6.5 Supplier performance and risk management.  
4.6.6 Supplier relationship management.  
4.6.7 Supplier offboarding.  
4.7 To implement supplier management, follow the process in Sections 5 and 6. Start by applying the principles in this practice to a few supplies and suppliers and work through all of the step...
SCOPE
1.1 This practice provides cannabis or hemp operations, or both, with methods, procedures, responsibilities, and criteria for supplier management practices to reliably receive supplies that meet specifications. Effective supplier management includes clear concise communication and comprehension between departments and business functions, that is, marketing, finance, operations, supply requirement analysis, supplier assessment or audits, supplier selection, backup suppliers, and supply/supplier information management.  
1.2 In this practice, the term cannabis can be substituted with the term hemp. This practice applies to industrial hemp operations, CBD operations, and as referred to by several authorities having jurisdiction, licensed marijuana operations.  
1.3 This practice provides a process for supplier management in Section 5 and criteria for supplier evaluation in Section 6.  
1.4 Nothing in this practice shall preclude observance of federal, state, or local regulations which may be more restrictive or have different requirements.  
1.5 This standard does not purport to address all of the safety concerns, if any, associated with its use. It is the responsibility of the user of this standard to establish appropriate safety, health, and environmental practices and determine the applicability of regulatory limitations prior to use.  
1.6 This international standard was developed in accordance with internationally recognized principles on standardization established in the Decision on Principles for the Development of International Standards, Guides and Recommendations issued by the World Trade Organization Technical Barriers to Trade (TBT) Committee.

SIGNIFICANCE AND USE
4.1 This practice is for any cannabis operation to use as a fundamental part of a robust quality management system (QMS).  
4.2 Regulators can use this practice to develop regulations that require the implementation of QMS principles, specifically management’s role and responsibilities. Further, regulators can use this practice to help build a checklist to evaluate management’s engagement and compliance with QMS based regulations.  
4.3 Auditors would use this practice to assess the level of management engagement with an operations QMS.  
4.4 Any cannabis operation that has implemented or seeks to implement a QMS would use this practice.
SCOPE
1.1 This practice provides the management responsibilities for the implementation and oversight of a quality management system (QMS). It can be applied to all cannabis operations, including cultivation, manufacturing, labeling, dispensing, and distribution. This practice does not address the quality management system details, but rather focuses on the main considerations for management’s role in setting up a QMS. Guide D8222 provides an overview and some details about the components of a QMS. Other standards provide details on specific QMS components.  
1.2 The term GxP as used in this practice is meant to include those good practices in the activities included in 1.1; namely cultivation, manufacturing, distribution, and all the relevant functions associated with these activities (for example, purchasing, testing, storing, and so forth).  
1.3 Although this practice mentions the importance of health and safety, it is done so in the context of overall management responsibility. This practice does not address details of a health and safety system, but it identifies the importance of this as a management responsibility.  
1.4 This practice encompasses a single component of the QMS (management responsibilities) that, when combined with the other elements, satisfies the requirements of a complete QMS.  
1.5 The practices described in this standard are intended to apply to all products of a cannabis plant including those that can be classified as hemp and which contain cannabinoids and can be consumed/ingested via mouth, nose, skin (whether described as medicine, supplements, food, cosmetics, and so forth.).  
1.6 This standard does not purport to address all of the safety concerns, if any, associated with its use. It is the responsibility of the user of this standard to establish appropriate safety, health, and environmental practices and determine the applicability of regulatory limitations prior to use.  
1.7 This international standard was developed in accordance with internationally recognized principles on standardization established in the Decision on Principles for the Development of International Standards, Guides and Recommendations issued by the World Trade Organization Technical Barriers to Trade (TBT) Committee.

SIGNIFICANCE AND USE
5.1 Effective decision-making in a quality systems-controlled environment comes from an informed understanding of quality issues and associated risks. As such, management should monitor and review the performance of the QMS at pre-planned and regular intervals to ensure the system’s effectiveness and identify opportunities for improvement of the QMS itself. Management should also provide oversight of the QMS by an independent quality practitioner(s) to assure its effectiveness.  
5.2 Moreover, risk-based decision-making encompasses all elements of the QMS and should be at the forefront of each decision. Consumer safety is the top priority, regardless of other considerations.  
5.3 Aspects of risk should be considered relative to intended (or unintended) uses of a product to ensure consumer safety. Management should assign priorities and adequate resources to activities or actions based on assessing the risk, including the probability of harm and the potential severity of that harm. It is essential to engage appropriate parties in evaluating the risk. Such parties may include:  
5.3.1 Consumers;  
5.3.2 Manufacturing personnel;  
5.3.3 Marketing personnel; and  
5.3.4 Other stakeholders, as needed.  
5.4 Implementation of risk management includes assessing the risks, implementing risk management controls commensurate with the level of risk, and evaluating the risk management efforts’ results. Risk management assessment is an iterative process and continues when additional information emerges that changes the potential risk’s nature.  
5.5 Risk management works in conjunction with process understanding to manage and control change and helps drive continuous improvement.
SCOPE
1.1 This guide focuses on the core elements of an effective quality management system (QMS) necessary to optimize consumer and product safety, product quality, and conformance with requirements from industry, governmental agencies, and other authorities having jurisdiction. This guide incorporates basic quality principles, guidelines, and industry best practices necessary to establish a QMS adaptable to all organizations.  
1.2 Laws and regulations from authorities having jurisdiction supersede recommendations within this guide.  
1.3 This standard does not purport to address all of the safety concerns, if any, associated with its use. It is the responsibility of the user of this standard to establish appropriate safety, health, and environmental practices and determine the applicability of regulatory limitations prior to use.  
1.4 This international standard was developed in accordance with internationally recognized principles on standardization established in the Decision on Principles for the Development of International Standards, Guides and Recommendations issued by the World Trade Organization Technical Barriers to Trade (TBT) Committee.

SIGNIFICANCE AND USE
4.1 Intended Use—This practice is intended for use by parties who either develop, plan, and conduct internal or external audits, or are interested in the audit process since they are the subject of compliance audits or they mandate such audits to occur.  
4.2 Audits—Audits are conducted by an auditor or audit body that is independent of the entity being audited. Individuals that conduct an assessment of an operation or product that they are directly involved with or have a vested interest in, is technically not an audit. These assessments might be a pre-audit or gap assessment. This practice can be used for these types of activities and the rigor of a true audit may not be as critical.  
4.3 Terms and Concepts—The definition of terms in Section 3 and the perspectives on scale, objectives, and types of audits in Annex A3 provide concepts that help clarify the different roles involved in an audit, the various elements of an audit, and how this practice applies to different situations. This practice is written in terms that accommodate audits for different objectives and sizes.  
4.4 Application—Compliance audits are used to identify gaps between some criteria and the actual operational conditions. Knowledge of gaps are used to assess various risks, guide corrective action, preventive action, root cause analysis, improvement efforts, prevent fines and penalties, or provide stakeholders an objective evaluation of an operation and its potential safety, financial, or other risks. A user of this practice should understand and adapt the audit concepts, process, and responsibilities in this practice to their specific organizational structure and situation.  
4.5 Audit Scale—The scale of an audit can range from an internal audit of a small single operation with fewer than ten employees to an external audit of a large corporation with facilities at multiple international locations. In either case, large or small, the principles in this practice shall be followed to produce...
SCOPE
1.1 Purpose—This practice identifies the minimum requirements for the planning, conduct, and reporting of compliance audits of a cannabis/hemp business. It provides information on terms, procedures, and responsibilities.  
1.2 Intent—The intent is to provide specific instruction needed to develop reliable audit programs and procedures that are used to conduct audits that produce credible, consistent, and objective evidence and findings related to compliance with one or more standards, regulations, policies, best practices, or quality specifications. This practice can be used internally for pre-audit assessments to identify and correct operational gaps.  
1.3 Organization—This practice is organized in the following manner:    
Section  
Scope  
1  
Referenced Documents  
2  
Terminology  
3  
Significance and Use  
4  
Audit Process Overview  
5  
Audit Programs  
6  
Audit Process  
7  
Record Management  
8  
Keywords  
9  
Roles and Responsibilities  
Annex A1  
Auditor Qualifications and Staffing  
Annex A2  
Scale, Objectives, and Perspectives of an Audit  
Annex A3  
Process Diagrams  
Annex A4  
1.4 Nothing in this practice shall preclude observance of federal, state, or local regulations which may be more restrictive or have different requirements.  
1.5 This standard does not purport to address all of the safety concerns, if any, associated with its use. It is the responsibility of the user of this standard to establish appropriate safety, health, and environmental practices and determine the applicability of regulatory limitations prior to use.  
1.6 This international standard was developed in accordance with internationally recognized principles on standardization established in the Decision on Principles for the Development of International Standards, Guides and Recommendations issued by the World Trade Organization Technical Barriers to Trade (TBT) Committee.

SIGNIFICANCE AND USE
4.1 In this guide, steps are suggested for the effective development, control, and management of procedures and records required for an effective product recall/removal from the marketplace.  
4.2 This guide presents a systematic approach to procedures and documentation regarding the steps necessary to be taken in the event of a product recall or removal from the marketplace because of health, safety, or quality nonconformances.  
4.3 This guide provides a procedural basis for conducting a mock recall for purposes of evaluating the efficacy of an organization’s existing traceability systems.
SCOPE
1.1 This guide describes the general best-practices action plan for conducting product recall and removal/withdrawal as related to any incident requiring the recovery of cannabis-derived products. This guide applies to all cannabis-derived products commercially manufactured and distributed for consumer use. This guide is for suppliers, consumers, retailers, and distributors. A specific product recall decision is the result of unacceptable product safety and requires notification of the appropriate governmental agencies governing the entity’s product safety laws. Governing regulatory agencies expect a product to be recalled if it is deemed to be unsafe, misbranded, or adulterated. These governing agencies are referenced as regulatory agencies throughout this guide. Various jurisdictional regulatory agencies may have specific and additional recall requirements falling beyond the recommendations of this guide. In these cases, the requirements of the governing regulatory agency must be followed. This document also provides general guidelines for the removal/withdrawal of products from the marketplace. Product removal/withdrawal is undertaken for purely commercial reasons that are typically unrelated to product safety and does not require regulatory agency notification. Product removal/withdrawal is carried out in the same manner as a product recall. This guide is being published as a best-practices approach and does not replace absolute jurisdictional regulatory requirements.  
1.2 The values stated in SI units are to be regarded as standard. No other units of measurement are included in this standard.  
1.3 This standard does not purport to address all of the safety concerns, if any, associated with its use. It is the responsibility of the user of this standard to establish appropriate safety, health, and environmental practices and determine the applicability of regulatory limitations prior to use.  
1.4 This international standard was developed in accordance with internationally recognized principles on standardization established in the Decision on Principles for the Development of International Standards, Guides and Recommendations issued by the World Trade Organization Technical Barriers to Trade (TBT) Committee.

SIGNIFICANCE AND USE
3.1 A product complaints program is an essential part of the organization’s Quality Management System. The ability to document, investigate, and correct issues related to product complaints provides manufacturers with opportunities for improvement. Putting in place appropriate corrective and preventive actions can lead to increased customer satisfaction, product safety, and increased market share.  
3.2 Requirements of regulatory bodies or governmental departments supersede the recommendations in this guide.
SCOPE
1.1 This guide is applicable to organizations engaged in the cultivation, processing, testing, packaging and labeling, storage, distribution, or transportation of cannabis products intended for human and animal consumption, including those derived from hemp. This guide describes the minimum requirements for maintaining a product complaint system for finished cannabis products and ensures that all complaints are received, processed, investigated, documented, and appropriate corrective and preventive actions are implemented in a timely manner.  
1.2 This guide applies to all cannabis-derived products commercially manufactured and distributed for consumer use.  
1.3 Units—The values stated in SI units are to be regarded as the standard. No other units of measurement are included in this standard.  
1.4 This standard does not purport to address all of the safety concerns, if any, associated with its use. It is the responsibility of the user of this standard to establish appropriate safety, health, and environmental practices and determine the applicability of regulatory limitations prior to use.  
1.5 This international standard was developed in accordance with internationally recognized principles on standardization established in the Decision on Principles for the Development of International Standards, Guides and Recommendations issued by the World Trade Organization Technical Barriers to Trade (TBT) Committee.

SIGNIFICANCE AND USE
3.1 The ability to identify and respond to opportunities before issues become systemic or are a risk to consumer health and safety is vital to maintaining compliance and achieving consumer expectations. The CAPA process is a systematic approach for documenting, identifying, and correcting existing and potential quality issues from various data sources. The CAPA subsystem analyzes and trends data inputs from quality systems and processes to identify if a quality issue is recurring, systemic in nature, or impacts consumer health and safety (see Fig. 1).
FIG. 1 CAPA Process versus CAPA Subsystem
SCOPE
1.1 This guide applies to all entities that cultivate, process, manufacture, test, and distribute cannabis products.  
1.2 This guide defines corrective action and preventive action (CAPA) and the significance of an effective CAPA process and CAPA subsystem.  
1.3 This guide defines instruction on the establishment of adequate processes and procedures for the identification, analysis, measurement, and correction of quality issues.  
1.4 This standard does not purport to address all of the safety concerns, if any, associated with its use. It is the responsibility of the user of this standard to establish appropriate safety, health, and environmental practices and determine the applicability of regulatory limitations prior to use.  
1.5 This international standard was developed in accordance with internationally recognized principles on standardization established in the Decision on Principles for the Development of International Standards, Guides and Recommendations issued by the World Trade Organization Technical Barriers to Trade (TBT) Committee.

SIGNIFICANCE AND USE
5.1 This practice provides general guidelines for the development and implementation of a HACCP system for operations that manufacture cannabis consumable products to prevent, control, or minimize hazards (biological, chemical, or physical) to an acceptable level. A HACCP system can prevent consumer harm when implemented and followed correctly.
SCOPE
1.1 This practice addresses the principles to follow when implementing and managing a Hazard Analysis Critical Control Point (HACCP) system for cannabis consumable products. This practice is not intended for cannabis industrial products (e.g., hemp products).  
1.2 Units—The values stated in SI units are to be regarded as standard. No other units of measurement are included in this standard.  
1.3 This standard does not purport to address all of the safety concerns, if any, associated with its use. It is the responsibility of the user of this standard to establish appropriate safety, health, and environmental practices and determine the applicability of regulatory limitations prior to use.  
1.4 This international standard was developed in accordance with internationally recognized principles on standardization established in the Decision on Principles for the Development of International Standards, Guides and Recommendations issued by the World Trade Organization Technical Barriers to Trade (TBT) Committee.

SIGNIFICANCE AND USE
5.1 Effective decision-making in a quality systems-controlled environment comes from an informed understanding of quality issues and associated risks. As such, management should monitor and review the performance of the QMS at planned intervals to ensure the system’s effectiveness and identify opportunities for improvement of the QMS itself. Management should also provide oversight of the QMS by an independent quality practitioner(s) to assure its effectiveness.  
5.2 Moreover, risk-based decision-making encompasses all elements of the QMS and should be at the forefront of each decision. Consumer safety is the top priority, regardless of other considerations.  
5.3 Aspects of risk should be considered relative to intended (or unintended) uses of a product to ensure consumer safety. Management should assign priorities and adequate resources to activities or actions based on assessing the risk, including the probability of harm and the potential severity of that harm. It is essential to engage appropriate parties in evaluating the risk. Such parties may include:  
5.3.1 Consumers;  
5.3.2 Manufacturing personnel;  
5.3.3 Marketing personnel; and  
5.3.4 Other stakeholders, as needed.  
5.4 Implementation of risk management includes assessing the risks, implementing risk management controls commensurate with the level of risk, and evaluating the risk management efforts’ results. Risk management assessment is an iterative process and continues when additional information emerges that changes the potential risk’s nature.  
5.5 Risk management works in conjunction with process understanding to manage and control change and helps drive continuous improvement.
SCOPE
1.1 This guide focuses on the core elements of an effective quality management system (QMS) necessary to assure consumer and product safety, product quality, and conformance with requirements from industry, governmental agencies, and other authorities having jurisdiction. This guide incorporates basic quality principles, guidelines, and industry best practices necessary to establish a QMS adaptable to all organizations.  
1.2 Laws and regulations from authorities having jurisdiction supersede recommendations within this guide.  
1.3 This standard does not purport to address all of the safety concerns, if any, associated with its use. It is the responsibility of the user of this standard to establish appropriate safety, health, and environmental practices and determine the applicability of regulatory limitations prior to use.  
1.4 This international standard was developed in accordance with internationally recognized principles on standardization established in the Decision on Principles for the Development of International Standards, Guides and Recommendations issued by the World Trade Organization Technical Barriers to Trade (TBT) Committee.

SIGNIFICANCE AND USE
4.1 Intended Use—This practice is intended for use by parties who either develop, plan, and conduct internal or external audits, or are interested in the audit process since they are the subject of compliance audits or they mandate such audits to occur.  
4.2 Terms and Concepts—The definition of terms in Section 3 and the perspectives on scale, objectives, and types of audits in Annex A3 provide concepts that help clarify the different roles involved in an audit, the various elements of an audit, and how this standard applies to different situations. This standard is written in terms that accommodate audits for different objectives and sizes.  
4.3 Application—Compliance audits are used to identify gaps between some criteria and the actual operational conditions. Knowledge of compliance gaps are used to assess various risks, guide corrective action and improvement efforts, prevent fines and penalties, or provide stakeholders an objective evaluation of an operation and its potential safety, financial, or other risks. A user of this practice should understand and adapt the audit concepts, process, and responsibilities in this practice to their specific organizational structure and situation.  
4.4 Audit Scale—The scale of an audit can range from an internal audit of a small single operation with fewer than ten employees to an external audit of a large corporation with facilities at multiple international locations. In either case, large or small, the principles in this practice shall be followed to produce objective and credible results.  
4.5 Audit Criteria—As the cannabis industry develops globally and continues to gain acceptance, both new and previously established standards, regulations, policies, and best practices are being developed, adopted, evolving, and applied to this industry. Due to this evolving nature, diligent attention is needed by auditing bodies to maintain up-to-date audit criteria and protocols.
SCOPE
1.1 Purpose—This practice identifies the minimum requirements for the planning, conduct, and reporting of compliance audits of a cannabis/hemp business. It provides information on terms, procedures, and responsibilities.  
1.2 Intent—The intent is to provide specific instruction needed to develop reliable audit programs and procedures that are used to conduct audits that produce credible, consistent, and objective evidence and findings related to compliance with one or more standards, regulations, policies, best practices, or quality specifications.  
1.3 Organization—This practice is organized in the following manner:    
Section  
Scope  
1  
Referenced Documents  
2  
Terminology  
3  
Significance and Use  
4  
Audit Process Overview  
5  
Audit Programs  
6  
Audit Process  
7  
Record Management  
8  
Keywords  
9  
Roles and Responsibilities  
Annex A1  
Auditor Qualifications and Staffing  
Annex A2  
Scale, Objectives, and Perspectives of an Audit  
Annex A3  
1.4 Nothing in this practice shall preclude observance of federal, state, or local regulations which may be more restrictive or have different requirements.  
1.5 This standard does not purport to address all of the safety concerns, if any, associated with its use. It is the responsibility of the user of this standard to establish appropriate safety, health, and environmental practices and determine the applicability of regulatory limitations prior to use.  
1.6 This international standard was developed in accordance with internationally recognized principles on standardization established in the Decision on Principles for the Development of International Standards, Guides and Recommendations issued by the World Trade Organization Technical Barriers to Trade (TBT) Committee.