Document Center is acquired by Nimonik

1.1 Purpose—This practice identifies the minimum requirements for the planning, conduct, and reporting of compliance audits of a cannabis/hemp business. It provides information on terms, procedures, and responsibilities.

1.2 Intent—The intent is to provide specific instruction needed to develop reliable audit programs and procedures that are used to conduct audits that produce credible, consistent, and objective evidence and findings related to compliance with one or more standards, regulations, policies, best practices, or quality specifications. This practice can be used internally for pre-audit assessments to identify and correct operational gaps.

1.3 Organization—This practice is organized in the following manner:

1.4 Nothing in this practice shall preclude observance of federal, state, or local regulations which may be more restrictive or have different requirements.

1.5 This standard does not purport to address all of the safety concerns, if any, associated with its use. It is the responsibility of the user of this standard to establish appropriate safety, health, and environmental practices and determine the applicability of regulatory limitations prior to use.

1.6 This international standard was developed in accordance with internationally recognized principles on standardization established in the Decision on Principles for the Development of International Standards, Guides and Recommendations issued by the World Trade Organization Technical Barriers to Trade (TBT) Committee.

4.1 Intended Use—This practice is intended for use by parties who either develop, plan, and conduct internal or external audits, or are interested in the audit process since they are the subject of compliance audits or they mandate such audits to occur.

4.2 Audits—Audits are conducted by an auditor or audit body that is independent of the entity being audited. Individuals that conduct an assessment of an operation or product that they are directly involved with or have a vested interest in, is technically not an audit. These assessments might be a pre-audit or gap assessment. This practice can be used for these types of activities and the rigor of a true audit may not be as critical.

4.3 Terms and Concepts—The definition of terms in Section 3 and the perspectives on scale, objectives, and types of audits in Annex A3 provide concepts that help clarify the different roles involved in an audit, the various elements of an audit, and how this practice applies to different situations. This practice is written in terms that accommodate audits for different objectives and sizes.

4.4 Application—Compliance audits are used to identify gaps between some criteria and the actual operational conditions. Knowledge of gaps are used to assess various risks, guide corrective action, preventive action, root cause analysis, improvement efforts, prevent fines and penalties, or provide stakeholders an objective evaluation of an operation and its potential safety, financial, or other risks. A user of this practice should understand and adapt the audit concepts, process, and responsibilities in this practice to their specific organizational structure and situation.

4.5 Audit Scale—The scale of an audit can range from an internal audit of a small single operation with fewer than ten employees to an external audit of a large corporation with facilities at multiple international locations. In either case, large or small, the principles in this practice shall be followed to produce objective and credible results.

4.6 Audit Criteria—As the cannabis/hemp industry develops globally and continues to gain acceptance, both new and previously established standards, regulations, policies, and best practices are being developed, adopted, evolving, and applied to this industry. Due to this evolving nature, diligent attention is needed by auditing bodies to maintain up-to-date audit criteria and protocols.