Cannabis is one of the most heavily regulated products in the country, yet because it remains federally illegal, there is no single federal Good Manufacturing Practice (GMP) standard for it. That gap is exactly why a third-party audit matters so much. It is how a cannabis company proves, to regulators, retailers, and consumers, that its products are made safely and consistently.
A third-party GMP audit is an independent assessment of your cannabis operation against Good Manufacturing Practice standards, performed by an accredited certification body with no stake in the result. Below are five reasons it is crucial, the standards that actually apply to cannabis, and how to get certified.
Key Takeaways
- There is no federal cannabis GMP, so states, retailers, and multi-state operators set the bar, and a third-party audit is how you meet it.
- CSQ is the cannabis-specific option. Cannabis Safety & Quality is built on the same principles as GFSI-benchmarked food standards and FDA GMP frameworks.
- GMP frameworks that apply: most cannabis ingestibles are audited against dietary supplement cGMPs (21 CFR 111) or food cGMPs (21 CFR 117), plus state rules.
- Requirements vary by state. New York, for example, requires a qualified third-party GMP audit for processors.
- Certification is a market advantage, not just compliance. It drives retail access, consumer trust, and expansion.
5 Reasons Third-Party Audits Are Crucial for Cannabis Companies
1. Adherence to stringent quality standards
GMP regulations set comprehensive guidelines for the production, testing, and distribution of products. A third-party audit focused on GMP compliance evaluates your processes, facilities, personnel, and documentation, confirming that cannabis products meet established quality specifications and protecting consumer safety.
2. Consistency in product quality
Consistency is everything in cannabis. By scrutinizing standard operating procedures, quality control measures, and documentation, third-party audits minimize variability in production. Consistent quality builds a reputation for reliability, which is the groundwork for sustained success.
3. Risk mitigation and regulatory compliance
An audit is a systematic review that surfaces compliance gaps before regulators or a recall do. Catching issues early lets you fix them, avoid penalties, and keep a positive standing with your state regulator. Strong root cause analysis on any finding is what keeps it from returning.
4. Stronger market position and consumer confidence
A successful GMP audit results in a certification that carries real weight. It differentiates you from competitors, reassures consumers of product safety, and works as a marketing asset that builds long-term loyalty.
5. International expansion and partnerships
For companies eyeing new markets or partnerships with larger operators, GMP compliance is often a prerequisite. A third-party audit shows your operation aligns with recognized quality standards, opening doors to collaborations and markets with strict requirements.
What GMP Standards Apply to Cannabis?
Because there is no federal cannabis GMP, cannabis companies are audited against a few recognized frameworks. Which one fits depends on your product, your state, and your buyers. Kiwa ASI audits cannabis operations against all of the below.
| Standard | What it is | Best for |
|---|---|---|
| CSQ (Cannabis Safety & Quality) | The leading cannabis-specific safety and quality certification, built on the principles of GFSI-benchmarked food standards and FDA GMP frameworks | Operators who want a purpose-built cannabis certification recognized across the industry |
| cGMP (21 CFR 111) | The FDA's dietary supplement current good manufacturing practices, the most common baseline applied to cannabis ingestibles | Edibles, tinctures, capsules, and other ingestible cannabis products |
| cGMP (21 CFR 117) | The FDA's food current good manufacturing practices and preventive controls | Cannabis-infused foods and beverages |
| State-mandated GMP | Requirements written into individual state cannabis rules, which vary widely | Any operator whose state names a specific standard or audit |
Cannabis GMP Requirements Vary by State
With no federal standard, the requirement to be audited, and against what, is set state by state. Some states mandate a third-party GMP audit outright; others require GMP practices without a certificate; others are silent and leave it to the market. A few examples of how Kiwa ASI supports operators:
- New York requires a qualified third-party GMP audit for processors.
- Ohio and Missouri have their own program expectations for cannabis operators.
- Florida and Maryland each set specific manufacturing and testing rules.
Check your state's rules first; if a scheme or audit is named, that decides your path.
How to Get a Cannabis GMP Audit
- Confirm your requirement. Start with your state rules and any buyer or multi-state operator requirements.
- Choose your standard. CSQ for a cannabis-specific certification, or a cGMP audit against 21 CFR 111 or 117 depending on your product.
- Run a gap assessment. An expert review shows where your system falls short and what to fix first.
- Build and document the system, from SOPs and quality controls to records and training.
- Complete the audit with an accredited certification body, then maintain it on the required cycle.
Ready to get your cannabis operation audited? Kiwa ASI offers CSQ certification and cannabis GMP audits against 21 CFR 111 and 117. Request a quote to get started.
Frequently Asked Questions
Q: Is cannabis GMP certification required?
A: There is no federal mandate, because cannabis is federally illegal, so no federal GMP rule applies. In practice, requirements come from states (New York, for example, mandates a qualified third-party GMP audit for processors), from retailers, and from multi-state operators who require it of their supply chain.
Q: What is CSQ certification?
A: CSQ (Cannabis Safety & Quality) is the leading cannabis-specific safety and quality certification program. It is built on the principles of GFSI-benchmarked food safety standards and FDA good manufacturing practice frameworks, adapted to the realities of cannabis.
Q: What GMP standard applies to cannabis edibles?
A: Most cannabis ingestibles are audited against the FDA's dietary supplement cGMPs (21 CFR 111), and cannabis-infused foods and beverages against food cGMPs (21 CFR 117), on top of any state-specific rules.
Q: What does a cannabis GMP audit cover?
A: It evaluates your processes, facilities, personnel, and documentation against the chosen standard, confirming that products are made consistently and safely and that your records prove it.
Related reading
- What Is GFSI Certification?
- Root Cause Analysis in SQF Audits
- The Difference Between Validation and Verification
Sources
[1] U.S. Food and Drug Administration. FDA Regulation of Cannabis and Cannabis-Derived Products.
[2] Electronic Code of Federal Regulations. 21 CFR Part 111: Current Good Manufacturing Practice for Dietary Supplements.