SQF, or Safe Quality Food, is a comprehensive assessment of a food manufacturing or processing facility's adherence to food safety and quality standards.
CanadaGAP is a food safety program for the fresh produce industry, based on HACCP principles. It covers good agricultural practices (GAP) for on-farm activities and good manufacturing practices (GMP) for packing and storage.
FSSC 22000 integrates ISO 22000 for comprehensive food safety management.
This certification covers multiple sectors such as food manufacturing, packaging, storage, distribution, and consumer products.
IFS Certification refers to a globally recognized certification system focused primarily on ensuring the safety, quality, and compliance of products and processes.
PrimusGFS certification is a food safety standard specifically designed for the fresh produce industry. It covers various aspects of food safety, including good agricultural practices (GAP), good manufacturing practices (GMP), and food safety management systems.
In person at our training center
Virtual, led by an Kiwa ASI expert
Learn anytime, at your pace
Live & on-demand · no cost
Phone hotline 1 (800) 477-0778 · US.Info@kiwa-asi.com
Kiwa ASI
Nearly a century of food safety expertise, headquartered in St. Louis.
Audits & Inspections
Independent second- and third-party audits for facilities at every stage.
Not sure which audit you need? Answer a few questions and see what fits. It takes about a minute.
Try the Audit Finder →cGMP Audits
Sector-specific Good Manufacturing Practice audits.
GFSI Certification
GFSI-benchmarked programs accepted by major retailers worldwide.
Not sure which audit you need? Answer a few questions and see what fits. It takes about a minute.
Try the Audit Finder →Cannabis Certification
Prove product safety in cultivation, extraction and manufacturing.
Cosmetics Certification
GMP for the cosmetics industry, including MoCRA readiness.
Dietary Supplement Certification
Go beyond basic GMPs with GFSI-benchmarked quality management.
CSR & Sustainability
Certifications for sourcing, allergens and environmental claims.
Food & Beverage
Audits and certification from primary production to complex manufacturing.
Cannabis
CSQ, GMP and state-specific regulatory audits.
Certification
State programs
In every tier, CSQ certification is an independent way to prove your program.
Regulatory QMS
Not sure which program your license requires? Our team maps state rules to the right audit.
Talk to a cannabis specialist →Cosmetics
GMP verification for beauty and personal-care manufacturers.
Dietary Supplements
FDA 21 CFR 111 compliance and GFSI-level quality.
Live Trainings in St. Louis
In-person classes at our St. Louis headquarters.
Live Instructor-Led Training
Virtual classes led by Kiwa ASI instructors.
SQF Edition 10
FDA & Regulatory
Hazards & Controls
Online Self-Paced Training
Learn on your schedule with e-learning courses.
Free Webinars
A 6-part 2026 series on SQF Edition 10, supplier management and compliance.
Resources
Articles, answers and media from the Kiwa ASI team.
Forms
Order certification banners or submit feedback.
Show Me Food Safety Scholarship
Supporting the next generation of food safety professionals.
Cannabis GMP certification is an independent audit that proves a licensed cannabis or hemp operation follows Good Manufacturing Practices: clean facilities, controlled processes, trained people, complete records and a working recall plan. No federal rule requires it, but New York, Florida and Maryland require a third-party GMP audit for some licensees, and other states write GMP into their cannabis rules. Kiwa ASI audits to CSQ (Cannabis Safety & Quality), a cannabis-specific GMP standard with three levels, scored out of 100 and renewed every year.
Last updated September 29, 2026
Tell us your license type and state. A cannabis audit specialist will reach out about scope, level and scheduling.
Good Manufacturing Practices (GMP) are the controls that keep a product safe and consistent: sanitary facilities and equipment, pest and water control, trained and hygienic staff, written procedures, batch and inventory records, supplier approval, and a way to trace and recall product. Cannabis GMP certification means an independent auditor has checked those controls at your licensed site and found that they meet a published GMP standard.
Most states write GMP-style rules into their cannabis regulations and check them by inspection. A certificate is the third-party proof on top: some states require it, and buyers, investors and regulators increasingly ask for it. For licensed cannabis operations, the cannabis-specific standard is CSQ (Cannabis Safety & Quality), which Kiwa ASI audits.
Since April 28, 2026, marijuana made under a state medical license is in Schedule III (91 FR 22714); adult-use marijuana is still Schedule I while DEA finishes its hearing. Neither step created a federal GMP rule or audit requirement. For hemp, a new federal definition phases in: products with cannabinoids the plant can't naturally produce lose hemp status on November 12, 2026, and the rest of the new definition, including a 0.4 mg total THC cap per container, applies from December 11, 2026 (P.L. 119-103). What it means for hemp.
CSQ standards cover cultivation, extraction, manufacturing, retail and warehousing & distribution, with requirements for cannabinoid products and processes.
Level 1 is GMP, Level 2 adds HACCP, and Level 3 adds an advanced quality management system with unannounced recertification audits.
Minor, major and critical nonconformities deduct 1, 10 and 100 points. A score of 70 or higher earns a certificate.
Certificates expire one year and 45 days after the last audit day, so sites are recertified annually, with an unannounced audit at least every three years.
There's no federal GMP rule for cannabis, and no federal law requires a third-party GMP certificate. Cannabis GMP requirements come from the states, and they range from full mandates to none. So the answer depends on your state and license type:
Marijuana is still a controlled substance: state-medical marijuana moved to Schedule III on April 28, 2026, and adult-use marijuana is still Schedule I. FDA has no cannabis-specific GMP rule, and rescheduling didn't create one.
New York requires processors to pass a third-party GMP audit, Florida requires one for every medical marijuana treatment center processing facility, and Maryland requires an accredited GMP certificate for high-potency edibles.
Missouri requires every licensee to implement a quality management system using a published standard, such as ISO, ASTM or CSQ, within one year of approval to operate.
California, Nevada, Ohio, New Jersey, Michigan and others write GMP or food-safety rules into their cannabis regulations and verify them by inspection. A certificate is voluntary, and it's how operators prove the GMP they already owe.
Rules change often. Check your state's page below for the current citations, and confirm with your regulator before you rely on any requirement.
Three states require a third-party GMP audit or certificate for some licensees (Florida, Maryland, New York), Missouri requires a quality management system built on a published standard, and the rest set GMP or sanitation rules without requiring a certificate. Pick your state for the full rules, license-by-license CSQ guidance and FAQs.
Edible makers need a state food-establishment license under Arizona's food code (9 A.A.C. 8) and must meet the cleaning and sanitation rule (A.A.C. R9-18-315). No third-party GMP certificate is required.
Manufacturers must run a full, documented GMP program (4 CCR §§17207–17218), verified by DCC inspection. No third-party GMP certificate is required.
Every licensee must meet the General Sanitary Requirements (Rule 3-310), and products manufacturers the health and safety rules of Rule 3-335. No third-party GMP certificate is required.
Every Medical Marijuana Treatment Center processing facility must pass a third-party Food Safety GMP inspection within 12 months of licensure (§ 381.986(8)(e)9, Fla. Stat.).
Processors must run a GMP program (COMAR 14.17.11). An accredited third-party GMP certificate is required for high-potency edibles and voluntary for other products. Kiwa ASI is an ANAB-accredited (ISO/IEC 17065) CSQ certification body.
Edible producers must comply with federal human-food GMP (21 CFR Part 117). The rules expressly allow voluntary GMP certification by an ISO/IEC 17065-accredited body (R 420.305(4)). Kiwa ASI is an ANAB-accredited (ISO/IEC 17065) CSQ certification body.
Licensees must implement a quality management system using a published standard, such as ISO, ASTM, CSQ or FOCUS, within one year of approval to operate (19 CSR 100-1.100(4)(D)).
GMP rules apply to cultivation, production and sales facilities and consumption lounges (NAC 678B.460–678B.523). No third-party GMP certificate is required.
Cannabis products must be made under GMP per 21 CFR Parts 110 and 210 (N.J.A.C. 17:30-11.12(a)5), verified by CRC licensing and inspection. No third-party GMP certificate is required.
Adult-use processors and medical registered organizations must pass a third-party GMP audit against 21 CFR Part 111 or 117 by an accredited certification body within one year of starting operations. Kiwa ASI is an ANAB-accredited (ISO/IEC 17065) CSQ certification body.
Every cultivator and processor must follow written GMP policies (OAC 1301:18-4-01, since January 1, 2026), and processors should expect a state GMP inspection before renewal. No third-party certificate is required.
Edible processors must meet Oklahoma's food code (OAC 310:257 and 310:260) and hold a food-establishment license. No third-party GMP certificate is required.
Grower/processors must process in a safe and sanitary manner under GMP-style rules (28 Pa. Code §§1151a.27, 1151a.33). Edibles aren't permitted. No third-party GMP certificate is required.
Processors that manufacture register with the state's manufactured-food program (R66-2-11). No third-party GMP certificate is required.
Operating somewhere else? The CSQ standards apply in any jurisdiction where cannabis or hemp is legal, and each audit checks your site against your local regulations. Tell us your state.
Pick the standard that matches what your site does. A site that does more than one activity, such as extraction and manufacturing, can be audited to more than one standard. Every standard shares Module 1 (the management system) and Module 5 (advanced requirements). See the CSQ certification page for the full standards.
All stages of cultivating cannabis plants: good agricultural practices before harvest and GMP for harvest and post-harvest.
Concentrates and extracts, isolated and purified cannabinoids, and converted cannabinoids.
Manufacture and packing of consumer and non-consumer cannabinoid products, such as edibles, beverages, topicals and vapes.
Good handling practices for selling cannabinoid products; deli-style adds packing and labeling flower at the point of sale and making pre-rolls.
Good distribution practices for handling, storing and distributing cannabinoid products.
A pass/fail scope extension for Level 2 or 3 certified operations that make dietary supplements.
Every CSQ standard has three levels of conformance. Each level adds a module, so start where your state or customers set the bar and move up as your system matures.
The GMP foundation for your license type.
Level 1 plus a hazard analysis and critical control points plan.
Level 2 plus an advanced safety and quality management system.
Tell us your state and what your operation does. We'll show the CSQ standard, level and modules to ask for, with the minimum audit time.
Loading the Audit Finder… If it doesn't appear, call 1 (800) 477-0778 or request a quote and we'll help you choose.
An initial CSQ audit has three parts: an off-site evaluation of your documentation (about one day, no more than six months before the site visit), the on-site audit at your physical location, and the report write-up. The auditor checks your written system, watches your people work, and samples your records against every requirement for your standard and level.
| Module | What the auditor checks |
|---|---|
| 1 Management system (all licenses) | Documented CSQ system with SOPs and a copy of local regulations, management commitment, regulatory compliance, records, internal audits, CAPA, complaints, recalls and withdrawals, product defense, fraud prevention, crisis management |
| 2A Good manufacturing practices | Facility and infrastructure, equipment and calibration, cleaning and sanitation, waste, integrated pest management, air and water safety, environmental monitoring, storage, inventory, supplier approval, production and process controls, personnel |
| 2B Good handling or distribution practices | The retail and warehousing & distribution version of Module 2: the same topics without environmental monitoring, with product handling or warehousing and distribution controls |
| 3A–3E Cannabinoid products and processes | Requirements specific to cultivation (3A), extraction (3B), manufacturing (3C), deli-style retail (3D) or cannabinoid materials and products in retail and distribution (3E) |
| 4A / 4B HACCP (Level 2+) | Full HACCP with a certified team leader and backup, hazard analysis, critical control points, validation and verification; basic HACCP for standard retail |
| 5 Advanced QMS (Level 3) | Advanced management system requirements, safety and quality culture, customer satisfaction and product realization |
| Mock recall and traceability | A mock recall at least once a year, completed in under two hours, plus a traceability exercise during the audit |
Each audit starts at 100, and every nonconformity deducts points. The final score decides the outcome:
| Result | Score | What happens next |
|---|---|---|
| Certified | 80–100 | Certificate; next audit in a year |
| Certified with surveillance | 70–79 | Certificate plus a surveillance audit in six months |
| Not certified | 0–69 | No certificate; wait six months to reapply |
Sites scoring 70–79 must bring their next surveillance audit into the certified range or the certificate is suspended. Certificates are listed with their score on CSQ's public registry.
A requirement that hasn't been implemented and is a significant risk. A critical finding means automatic failure, and falsified records lead to withdrawal.
A deficiency that will likely lead to a safety or quality risk.
A deficiency that may lead to a safety or quality risk.
After the audit: draft findings are sent within 7 days, corrective actions must be approved and closed within 30 calendar days of the closing meeting, and the final report and certificate follow within 45 days. Certified sites must report a recall within 72 hours.
A certificate turns the GMP work you already do for your regulator into scored, independent evidence that other people can check.
Missouri names CSQ among the published standards licensees can use, and Florida, Maryland and New York require third-party GMP audits for some licensees. Your state's page explains what counts.
A certificate, score and public registry listing that retailers, brand partners, investors and insurers can verify.
Environmental monitoring, sanitation, supplier approval and process controls cut contamination, mislabeling and potency problems before product ships.
A yearly mock recall completed in under two hours, plus a traceability test at every audit.
Findings are scored out of 100, so you can track progress year over year and move from Level 1 to Level 2 or 3.
States keep adding GMP, packaging and testing rules. A certified system is already documented when the next rule lands.
Hemp and CBD products sit under a different set of federal rules from state-licensed marijuana, and those rules are changing. FDA's position is that CBD can't be sold as a dietary supplement or added to conventional food, and FDA's GMP rules still apply to the category a product is sold in. Hemp operators can certify to CSQ, or to a Kiwa ASI cGMP audit that matches their site:
Under P.L. 119-37, section 781, hemp is measured by total THC including THCA (0.3% or less on a dry weight basis). Products with cannabinoids synthesized or made outside the plant are excluded, and final products can hold no more than 0.4 mg of total THC per container. P.L. 119-103 delayed most of this: from November 12, 2026 only products with cannabinoids the plant can't naturally produce are excluded, and the full definition applies from December 11, 2026.
CSQ applies to legal cannabis, marijuana or hemp, regardless of regulatory classification, so hemp growers, extractors and product makers can certify to the same standards.
Kiwa ASI's HACCP-based standard founded on FDA's 21 CFR Part 117, for food and beverage manufacturing sites.
Third-party audits against FDA's dietary supplement cGMP rule. CSQ Level 2 or 3 certified sites can add CSQ's Dietary Supplement Addendum instead.
A GMP certificate shows how a product is made. It doesn't make a product legal to sell, so confirm your product's federal and state status before you rely on a certificate.
Audit fees are based on auditor time, so the biggest cost drivers are your CSQ level, the number of standards in scope, and your site's size and complexity. These are CSQ's minimum audit times for an initial audit:
Plus about 1 day off site for the documentation evaluation and half a day for the report.
Plus about 1 day off site for the documentation evaluation and 1 day for the report.
Plus about 1 day off site for the documentation evaluation and 1 day for the report.
Added to a Level 2 or 3 audit, scored pass/fail.
Also budget for an optional pre-assessment, training (such as HACCP for Level 2 and 3), any facility or equipment upgrades, and a six-month surveillance audit if you score 70–79. Call 1 (800) 477-0778 or request a quote for your site.
Most sites need several months to build and run a documented system before the audit. These are the steps:
Find out whether your state requires a third-party audit or a quality system, and by when. Start with the state guides above.
Match the CSQ standard to your license (cultivation, extraction, manufacturing, retail or distribution) and pick Level 1, 2 or 3.
Designate a CSQ Certification Program Manager and have them complete CSQ's online Certification Program Overview training.
Write the SOPs, prerequisite programs, forms, logs and training materials the standard requires, and keep a copy of your local regulations.
Train staff on the new procedures. For Level 2 or 3, certify a HACCP team member and a backup through an IHA-approved course.
Operate the system and collect records. CSQ recommends at least 60 days of records before the audit.
Run an internal audit and a mock recall, fix what you find, and consider a pre-assessment.
Request a quote and sign a certification agreement with a CSQ-licensed certification body.
Send documents for the off-site evaluation, then host the on-site audit at your licensed location.
Submit evidence for every nonconformity within 30 calendar days. Your certificate and registry listing follow the technical review.
Live virtual courses, taught by experienced food safety trainers, for the qualifications and programs CSQ asks for. CSQ's own Certification Program Overview training for your program manager is taken online through CSQ.
IHA-accredited HACCP certification. CSQ Level 2 and 3 need one certified person and a backup on the HACCP team (4A.2).
16 contact hours · 4 half-days · Live via Zoom · 8:30 AM–12:30 PM CT
Dates on request. Ask about upcoming dates
Plan, run and report the internal audits CSQ Module 1 requires (1.5), and follow up with corrective action (1.6).
Full day · Live online · 8:30 AM–2:30 PM CT
Dates on request. Ask about upcoming dates
Threat assessments and a defense plan, supporting CSQ's product defense and fraud prevention requirements (1.9, 1.10).
Full day · Live via Zoom · 8:30 AM–2:30 PM CT
Dates on request. Ask about upcoming dates
Design a risk-based environmental monitoring program for cultivation, extraction and manufacturing sites (2A.8).
Live virtual · Instructor-led
Dates on request. Ask about upcoming dates
The FSPCA Preventive Controls for Human Food course, for edible makers in states that point to FDA's 21 CFR Part 117.
FSPCA V2.0 · 5 half-days · Live via Zoom · 8:30 AM–12:30 PM CT
Dates on request. Ask about upcoming dates
Allergen risk assessment and cross-contact control for infused edibles and beverages.
4 hours · Live virtual · Instructor-led
Dates on request. Ask about upcoming dates
Build and measure the safety and quality culture that CSQ Level 3 audits (5.2).
Live virtual · Instructor-led
Need to train 6+ people? Ask about on-site private training. Training is delivered by ASI Training and Consulting, LLC, separately from certification, and taking a course has no effect on your audit result.
Kiwa ASI has audited food safety programs for decades and brings the same GMP discipline to licensed cannabis and hemp operations.
ASI Food Safety, LLC (Kiwa ASI) is currently CSQ's licensed certification body.
ANAB accreditation to ISO/IEC 17065 for CSQ, SQF and CanadaGAP certification.
Guides for 14 states map each license type to the right CSQ standard, and every audit checks your local regulations.
CSQ auditors hold a bioscience degree, IHA-recognized HACCP training and CSQ lead auditor training, and can't audit sites they consulted for in the past three years.
Reviewers independent of the auditor check every report before a certificate is issued.
Part of Kiwa, a testing, inspection and certification group operating in more than 30 countries.
It's an independent audit that confirms a licensed cannabis or hemp site follows Good Manufacturing Practices against a published standard. Kiwa ASI certifies to CSQ (Cannabis Safety & Quality), which has standards for cultivation, extraction, manufacturing, retail and warehousing & distribution.
Not federally: no federal law requires a GMP certificate for state-licensed cannabis. A few states do: New York (processors), Florida (medical marijuana treatment center processing facilities) and Maryland (high-potency edibles) require a third-party GMP audit or certificate, and Missouri requires a quality management system built on a published standard. Most other states set GMP rules and verify them by inspection.
New York requires adult-use processors and medical registered organizations to pass a third-party GMP audit within a year of starting operations. Florida requires every medical marijuana treatment center processing facility to pass a third-party Food Safety GMP inspection within 12 months of licensure. Maryland requires an accredited third-party GMP certificate for high-potency edibles. See rules by state.
No. FDA has no cannabis-specific GMP rule, and the April 28, 2026 rule that moved state-medical marijuana to Schedule III doesn't add one. Adult-use marijuana is still Schedule I while DEA finishes its hearing on moving all marijuana. FDA's existing GMP rules apply by product type (21 CFR Part 117 for food, Part 111 for dietary supplements, Parts 210 and 211 for approved drugs), and several states borrow them in their cannabis rules.
GMP is the set of practices; CSQ is a certification standard that audits them. CSQ Level 1 covers GMP for your license type, Level 2 adds HACCP and Level 3 adds an advanced quality management system.
Start with the level your state or customers expect. Level 1 proves GMP. Level 2 adds a HACCP plan and is required before the Dietary Supplement Addendum. Level 3 adds an advanced quality management system and unannounced recertification audits.
CSQ sets minimum on-site times of 1 day for Level 1, 1.5 days for Level 2 and 2 days for Level 3, plus about a day off site to evaluate your documents and time to write the report. Larger or multi-standard sites take longer.
The audit starts at 100. Minor nonconformities deduct 1 point, majors 10 and a critical 100 (automatic failure). A score of 80–100 is certified with an annual audit, 70–79 is certified with a six-month surveillance audit, and below 70 isn't certified.
A certificate expires one year and 45 days after the last day of the audit, so sites are recertified every year. Operations that need an audit before they start producing can get a provisional six-month certificate.
Every certified site gets an unannounced audit at least once every three years, and Level 3 recertification audits are always unannounced. Refusing an unannounced audit leads to suspension.
Yes. CSQ applies to legal cannabis, marijuana or hemp, regardless of regulatory classification. Hemp food and beverage sites can also use Kiwa ASI's cGMP Food Processing audit, and supplement sites a 21 CFR Part 111 audit. Note that FDA doesn't allow CBD in dietary supplements or conventional food, and the federal definition of hemp tightens on December 11, 2026 (a 0.4 mg total THC cap per container for final products).
CSQ recommends at least 60 days (two months) of records before your certification audit, along with your written procedures, prerequisite programs and a copy of your local regulations.
No. Certified operations can use the CSQ mark in marketing and on their website, but not on final product packaging.
Certification to CSQ is. ASI Food Safety, LLC (Kiwa ASI) is accredited by ANAB to ISO/IEC 17065 to certify to CSQ, and is currently CSQ's licensed certification body. CSQ itself is a standard, so it isn't accredited, and it isn't GFSI-benchmarked.
CSQ is owned by ASI Global Standards, LLC, which, like ASI Food Safety, is part of ASI Holdings. ASI Food Safety, LLC (Kiwa ASI) is currently CSQ's licensed certification body. CSQ publishes an impartiality statement on this relationship. Audits are run by qualified auditors who can't have consulted for your site in the past three years, and every report gets an independent technical review.
Your CSQ Certification Program Manager must complete CSQ's online Certification Program Overview training. For Level 2 and 3 (full HACCP), one person and a backup must hold HACCP certification from a course approved by the International HACCP Alliance, such as Kiwa ASI's HACCP training.
Fees are based on auditor time, which depends on your CSQ level, the standards in scope and your site's size and complexity. Budget as well for training, any facility upgrades and a pre-assessment if you want one. Request a quote for your site.
Tell us your state, license type and products, and we'll recommend a CSQ standard and level, quote your audit and schedule it around your operation.
ASI Food Safety, LLC (Kiwa ASI) is currently CSQ's licensed certification body, with ANAB accreditation to ISO/IEC 17065 for CSQ, SQF and CanadaGAP certification. CSQ is a standard, so it isn't itself accredited, and it isn't GFSI-benchmarked. CSQ is owned by ASI Global Standards, LLC, which, like ASI Food Safety, is part of ASI Holdings (see CSQ's program oversight and impartiality statement). Kiwa ASI training is delivered separately from certification.