Cannabis & GMP/GACP: Part 5 - Cannabis Management Systems

CMS Functionality

In terms of government regulations and industry standards, cannabis management software is an electronic records management system. Most business management software programs are essentially electronic records management systems regardless of what industry they are use in.

Since a computer record is only as secure as the system that holds it, the organization must therefore make certain that both the hardware and software comprising that system is secure. And since the hardware and software are only as secure as the facility they are located in, this also means securing the physical location of any servers or back-up copies of data and so on. If the hardware and software are stored elsewhere, such as in the case of cloud-based software, that location should be confirmed secure. As well, access to the system within the cannabis facility must also be secure. No computer system can meet such requirements—only an internal security policy and associated procedures can.

While we can’t stress enough that the physical practices are critical to meeting quality standards such as Good Manufacturing Practice (GMP) and Good Agricultural & Collection Practice (GACP), software can play a significant role by recording the activities of concern. A cannabis management system should meet the requirements for a computerized system, but the software should also offer all the functionality required for quality management and recordkeeping.

Following are the features to look for in a cannabis management system that will be used in a facility seeking GMP-certification.

Computerized System Requirements

• Maximum security and privacy of the hardware and software with a firewall and monitored intrusion system
• Encryption and security of sensitive data by both physical and electronic means against damage
• Stored data that is checked for accessibility, readability and accuracy with access ensured throughout the retention period
  Controlled access to data based on worker roles and security profiles
• Electronic signatures and multi-factor authentication to ensure only authorized employees access data and complete sensitive tasks

Good Production Practice

• A built-in quality management system with support for clearly defined standard operating procedures (SOPs)
• Recording of all production workflows carried out in the facility, which demonstrate that all the steps required by the defined procedures and instructions were in fact taken
• Sample management and recording of quality assurance testing with analysis results, including scanned copies of supporting documentation (e.g., certificate of analysis) if necessary
• Recording that the quantity and quality of the product was as expected
• Recording that no batch of product is released for sale or supply prior to certification by a Qualified Person that it is in accordance with the requirements of the relevant authorisations
• Recording of distribution that enables the complete history of a batch to be traced and retained in a comprehensible and accessible form

Deviations, Complaints & Recalls

• Recording of any significant deviations and investigations with the objective of determining the root cause and appropriate corrective and preventive action implemented
• Tracking of all pertinent information related to complaints, adverse reactions and severe adverse reactions
• A system for recording that complaints about products are examined, the causes of quality defects investigated and appropriate measures taken in respect of the defective products and to prevent reoccurrence
• An automated system to facilitate a recall of any batch of product from sale or supply

Waste & Destruction

• Tracking of waste material including where the waste was collected, by whom, the source of the waste (e.g., plant, batch, room, etc.), the weight, volume or count of the material and the current location of the waste item
• Recoding of destruction events including date, location, method, the authorized/qualified witnesses

Auditing & Reporting

• Complete audit trails for every action
• Product tracing to the lot or batch and ultimately back to the original genetic material
• Recording of the results of inspection and that testing of materials, intermediate, bulk, and finished products is formally assessed against specification
• Tracking of every interaction/communication with authorities, suppliers & clients
• Full compliance reporting, automated if possible to save time and facilitate audit success
• Controls to ensure the integrity of records throughout the retention period, with it clearly defined which record is related to each manufacturing activity and where this record is located

If your CMS offers all the above, not only will it help your business, but it will help make all compliance easier including GMP-certification.