As mentioned in earlier posts, any software used for Good Manufacturing Practice-related activities must be validated in the facility at the time of certification. Even if a software system has been validated in another facility in the past, it will need to be validated in your facility if you are becoming Good Manufacturing Practice-certified.

But it isn’t just the cannabis management system that will need to be validated. Any software used in relation to compliance-related activities or data must be validated at the time of GMP certification.

In addition, every piece of equipment must also be validated for GMP. Since most equipment today relies heavily on software for its operation, all of that software will need to validated along with the equipment.

The process is not only time-consuming but extremely costly. Some organizations have reported spending up to two years with costs into six figures on the GMP certification process.

Is there another option? Yes.

If Canadian LPs wish to sell cannabis in Europe or other GMP regions, there are two options.
a) Become Good Manufacturing Practice certified OR
b) Become Good Agricultural & Collection Practice certified and sell product in bulk to a producer who is GMP certified

There are pros and cons to both of these options.

While GMP certification lets producers sell their products directly to regions where it is required, as noted, the certification process involves validating every piece of equipment and software used in the facility. Plus, the cost for GMP certification is dependent on what products the licensed producer sells.

There is also a significant cost to maintaining a GMP certification including performing third-party vendor validations every two to three years as well as re-validating equipment and software when new releases/firmware updates are installed. These re-validation efforts require regression testing to perform complete process re-validation for all areas related to the specific equipment or software.

GACP certification does not permit producers to sell directly in GMP regions but does allow them to sell to GMP-certified producers. These certified producers can be in Canada or in the destination region.

Since GACP does not require third-party vendor validation nor equipment and software validation, time and costs to achieve certification are significantly reduced.

Whichever route you choose to take, if you use a cannabis management system in your facility, you should ensure that the software offers as many compliance-related features as possible.

If a software vendor claims their system is GMP-certified, it is not true. No software can become GMP-certified. A system can be validated in the GMP-certification process for a specific facility, but there is no GMP certification for software nor for equipment.
A software system having been validated in another facility that achieved GMP certification is an indication that it may meet compliance in your facility. But that is not a guarantee. If you are using software incorrectly or inconsistently, validation may fail.

And remember that all quality systems are heavily dependent on physical processes and practices. Software only supports the operation and supplies the recordkeeping and auditing. No software can make your facility GMP-compliant on its own.

CMS Functionality

In terms of government regulations and industry standards, cannabis management software is an electronic records management system. Most business management software programs are essentially electronic records management systems regardless of what industry they are use in.

Since a computer record is only as secure as the system that holds it, the organization must therefore make certain that both the hardware and software comprising that system is secure. And since the hardware and software are only as secure as the facility they are located in, this also means securing the physical location of any servers or back-up copies of data and so on. If the hardware and software are stored elsewhere, such as in the case of cloud-based software, that location should be confirmed secure. As well, access to the system within the cannabis facility must also be secure. No computer system can meet such requirements—only an internal security policy and associated procedures can.

While we can’t stress enough that the physical practices are critical to meeting quality standards such as Good Manufacturing Practice (GMP) and Good Agricultural & Collection Practice (GACP), software can play a significant role by recording the activities of concern. A cannabis management system should meet the requirements for a computerized system, but the software should also offer all the functionality required for quality management and recordkeeping.

Following are the features to look for in a cannabis management system that will be used in a facility seeking GMP-certification.

Computerized System Requirements

• Maximum security and privacy of the hardware and software with a firewall and monitored intrusion system
• Encryption and security of sensitive data by both physical and electronic means against damage
• Stored data that is checked for accessibility, readability and accuracy with access ensured throughout the retention period
  Controlled access to data based on worker roles and security profiles
• Electronic signatures and multi-factor authentication to ensure only authorized employees access data and complete sensitive tasks

Good Production Practice

• A built-in quality management system with support for clearly defined standard operating procedures (SOPs)
• Recording of all production workflows carried out in the facility, which demonstrate that all the steps required by the defined procedures and instructions were in fact taken
• Sample management and recording of quality assurance testing with analysis results, including scanned copies of supporting documentation (e.g., certificate of analysis) if necessary
• Recording that the quantity and quality of the product was as expected
• Recording that no batch of product is released for sale or supply prior to certification by a Qualified Person that it is in accordance with the requirements of the relevant authorisations
• Recording of distribution that enables the complete history of a batch to be traced and retained in a comprehensible and accessible form

Deviations, Complaints & Recalls

• Recording of any significant deviations and investigations with the objective of determining the root cause and appropriate corrective and preventive action implemented
• Tracking of all pertinent information related to complaints, adverse reactions and severe adverse reactions
• A system for recording that complaints about products are examined, the causes of quality defects investigated and appropriate measures taken in respect of the defective products and to prevent reoccurrence
• An automated system to facilitate a recall of any batch of product from sale or supply

Waste & Destruction

• Tracking of waste material including where the waste was collected, by whom, the source of the waste (e.g., plant, batch, room, etc.), the weight, volume or count of the material and the current location of the waste item
• Recoding of destruction events including date, location, method, the authorized/qualified witnesses

Auditing & Reporting

• Complete audit trails for every action
• Product tracing to the lot or batch and ultimately back to the original genetic material
• Recording of the results of inspection and that testing of materials, intermediate, bulk, and finished products is formally assessed against specification
• Tracking of every interaction/communication with authorities, suppliers & clients
• Full compliance reporting, automated if possible to save time and facilitate audit success
• Controls to ensure the integrity of records throughout the retention period, with it clearly defined which record is related to each manufacturing activity and where this record is located

If your CMS offers all the above, not only will it help your business, but it will help make all compliance easier including GMP-certification.

Software & Quality Systems

Many of the principles in quality systems are dependent on physical practices, such as safety measures, security protocols, training, and carrying out activities in a prescribed and consistent manner.

The role of software in the scope of standards is to deliver the means for managing or tracking those practices and providing recordkeeping for auditing & compliance.

Please be aware that software cannot, on its own, become ‘certified’ in relation to GMP or GACP for that matter. Only a facility can become certified for either quality system. Software, however, must be ‘validated’ against specific practices carried out in the facility for GMP certification. As noted, GACP does not require software validation.

Each facility must validate their compliance-related processes during certification. In the case of GMP, the software and equipment used in the facility must also be validated. In the case of GACP, software and equipment are not validated – only processes.

Regardless of whether validation of equipment and software is required, certification is always dependent on more than software. Most of the principles and practices of quality systems are outside the control of any software application.

The Role of Software in Certification

For GMP, any software used for compliance-related activities must be validated in the facility at the time of certification. Even if a system has been validated in another facility in the past, the software will need to be validated in your facility.

Since quality systems cover so many aspects of the operation, it is possible that more than one software application may be used in a facility for compliance-related activities. The facility may have a cannabis management system to track production, but it may also have a separate quality management system or a laboratory management system. There may be a learning management system used to track worker qualifications plus a financial system that manages supplier-related data.

As all of these systems have compliance implications, each one, as well as each piece of related equipment, would need to be validated during certification, not just the cannabis management system.

In fact, a cannabis management system is not even mandatory for a cannabis facility seeking certification. A facility could be using several software systems that together manage all the various aspects of operations, none of which is a cannabis management system, and still become certified. Certification would involve having each application validated against the processes it covers.

However, a cannabis management system should make certification of any quality system easier, especially if it offers comprehensive tracking of all compliance-related processes as well as full auditing and reporting. Compliance functionality is one of the main selling points of cannabis management systems.