GMP
Kiwa ASI cGMP V2.0 Training
One day on current Good Manufacturing Practices for the people who run your floor every day.
Upcoming dates$499 per seat
Dates on request. Ask about upcoming dates
Missouri’s Cannabis QMS Mandate: What the Rule Requires and How CSQ Fits
Missouri requires every licensed cannabis facility to implement a quality management system built on a published standard within one year of receiving approval to operate (19 CSR 100-1.100(4)(D)). The rule names four example standards, including Cannabis Safety & Quality (CSQ), and it does not require a certificate. Kiwa ASI audits and certifies cannabis and hemp operations to CSQ, turning the QMS you already owe Missouri into independent, documented proof.
- CSQ Certification Body
- 19 CSR 100-1.100(4)(D)
- QMS on a Published Standard
- Cannabis & Hemp
Last updated October 27, 2026
Get a Missouri CSQ Audit Quote
Tell us your license type, what you make, and when your facility was (or will be) approved to operate. We’ll confirm your CSQ standard and level and tell you the earliest audit dates we can offer against your one-year implementation clock.
Does Missouri’s QMS Mandate Apply to You?
If you hold a Missouri cannabis license, yes. The rule reaches every licensed facility type, cultivation, manufacturing, dispensary, microbusiness and testing facilities alike, and the grace period for transition-era operators ended December 1, 2023, so the mandate is fully in force for everyone. Here is the short version.
New for manufacturers: Cannabis Food Safety inspections
Since 2026, Missouri manufacturers of ingestible products face a second lane: scheduled Cannabis Food Safety inspections against food GMPs, 21 CFR 117, adopted through 19 CSR 20 and applied to cannabis manufacturing through 19 CSR 100-1.170. The Division of Cannabis Regulation (DCR) says the program introduces no new requirements; it checks the food-safety duties you already have. A QMS built on a standard with GMP content addresses both lanes at once, though no certification substitutes for the state’s own inspection.
-
Who
Who It Covers
Every licensed facility. 19 CSR 100-1.100(4)(D) says licensees, without carve-outs: cultivation, manufacturing, dispensary, microbusiness and testing facilities all carry the duty, applied to each facility type. For testing laboratories, Missouri itself names the standard: ISO/IEC 17025.
-
What
What It Requires
Implement a quality management system using a published standard, applicable to your facility type and implemented with emphasis on regulatory compliance. The rule requires implementation, not a certificate: no audit, no level and no certification is mandated.
-
When
Your Deadline
Within one year of the date the facility receives department approval to operate. That clock starts at approval to operate, not license issuance; approval to operate itself must come within one year of licensure, or two for microbusinesses (19 CSR 100-1.100(4)(E)).
-
Standards
Which Standards
The rule names four example standards, introduced by “such as”: ISO, ASTM International, Cannabis Safety and Quality (CSQ), and FOCUS. The list is illustrative, not exclusive. CSQ is purpose-built for cannabis operations, with standards covering cultivation, extraction, manufacturing, retail, and warehousing and distribution.
The QMS Rule, Decoded
The whole mandate is one sentence pair in 19 CSR 100-1.100(4)(D):
“(D) Licensees shall implement a quality management system using a published standard, such as those offered by International Organization for Standardization, ASTM International, Cannabis Safety and Quality, or Foundation of Cannabis Unified Standards, within one (1) year of the date the facility receives department approval to operate. The chosen standard shall be applicable to the licensee's facility type and be implemented with emphasis on regulatory compliance.”
Four readings decide your plan.
-
Reading 1
Implementation, Not Certification
Nothing in the rule, or anywhere in the chapter, requires a certificate, an audit, a level or HACCP. Missouri’s regulator has described the rule as requiring licensees to implement a QMS built on a published standard, and nothing in the rule or in DCR’s guidance requires a certificate. Certification is voluntary, independent proof that your QMS actually runs.
-
Reading 2
“Such As” Means Examples
The four named standards are examples, not an approved list. The rule’s own selection criteria are fit, the standard must match your facility type, and emphasis on regulatory compliance. That is the honest basis for choosing: pick the published standard that actually covers what you do.
-
Reading 3
The Clock Is Real
One year from the date your facility receives department approval to operate, written into the rule sentence itself. For a new facility that means the QMS work starts at buildout, not after opening. The transition-era waiver ended December 1, 2023, so no operating facility is outside the mandate today.
-
Reading 4
Facility-Type Fit
The chosen standard must apply to your facility type. CSQ publishes separate standards for cultivation, extraction, manufacturing, retail and warehousing and distribution, which is why most license types map cleanly onto one or two CSQ scopes. The Find-Your-Path section below matches each Missouri license to its standard.
Why you may have seen “(4)(C)” elsewhere. During the 2023 emergency-rule transition the QMS duty briefly carried different numbering, and some older explainers still cite it that way. In the current rule, (4)(C) is the general comply-with-all-requirements provision; the QMS mandate is (4)(D), unamended since July 30, 2023.
After Repeat Violations, DCR Can Pick for You
The QMS rule has teeth elsewhere in the chapter. Under 19 CSR 100-1.030(4)(B), cross the repeat-violation line and the choice stops being yours: DCR may require certification to a QMS standard it chooses, or a third-party audit of your processes, with every cost on you. DCR’s own Path to Compliance Guide (August 2026) says it plainly: the QMS provider or auditor is selected by DCR, and all associated costs are the responsibility of the licensee.
-
1.030(4)(B)
The Two Triggers
Initial Notices of Violation covering more than three rules in any twelve months, or more than one Initial NOV for the same regulation within twelve months. Either one opens the door. The rule says “may be required”, so it is DCR’s discretion, never automatic.
-
The order
What DCR Can Order
Certification or accreditation to a quality management system standard chosen by the department, at your expense, or an audit of the processes behind the violations by a third-party auditor chosen by the department, also at your expense.
-
The ladder
The Enforcement Ladder
Educational warning, then an Initial Notice of Violation with 15 days to respond, then a Final Notice of Violation with 30 days. The rule’s own sequence ends at suspension or a daily fine; DCR’s broader enforcement authority adds limitations, fines up to $100,000 for testing and sampling violations, suspension and revocation. Appeals go to the Administrative Hearing Commission within 30 days.
-
The choice
Voluntary Beats Ordered
Certifying voluntarily means you pick the standard, the level and the timing. Certifying after repeat violations means DCR picks, on DCR’s timeline, with the violations already on your record. A documented, independently audited QMS is also the strongest evidence you can hand an inspector along the way, and in a capped market that sold roughly $1.5 billion in 2025, operators compete on quality and shelf trust, which is where voluntary certification earns its keep.
The recall drumbeat makes this concrete. Missouri issued four product recalls in 2026 alone, for failed pathogen testing, synthetically derived cannabinoids, and testing done at the wrong production stage, and since mid-2025 DCR pulls its own samples during unannounced visits. In 2023, the state recalled roughly 60,000 products from a single manufacturer and ultimately revoked its license after regulators found systemic tracking and testing failures. Nearly every recall on the state’s list traces to a process failure a QMS is designed to catch: labeling control, testing sequence, traceability.
Match Your Missouri License to the Right CSQ Standard
The rule’s own criterion is facility-type fit, so match what you actually do to the CSQ standard that covers it. Missouri doesn’t name a level; the readiness checklist below shows what each level covers. If you hold more than one authorization, ask us how the standards in scope combine into a single agreed audit scope.
-
Comprehensive or micro
Cultivation Facility
Growing, harvesting, drying, curing and trimming. CSQ Cultivation Level 1 is built on good agricultural and collection practices plus good manufacturing practices, through post-harvest handling.
- Standard: CSQ Cultivation v2.0
- Level: Level 1 or higher; Level 2 adds HACCP
- No certificate mandated: certification is voluntary, independent proof
- Minimum audit: 1-day document review plus 1 day onsite at Level 1
-
Extraction · infused products
Manufacturing Facility
Extraction, infusion, edibles, beverages, vapes and topicals. Extraction maps to CSQ Extraction and finished products to CSQ Manufacturing; many Missouri manufacturers hold both, and we can confirm how the scopes combine into one audit. If you make ingestible products, this is also the license the Cannabis Food Safety inspection lane covers.
- Standard: CSQ Extraction and/or CSQ Manufacturing v2.0
- Level: Level 1 or higher; Level 2 adds HACCP
- Minimum audit: 1-day document evaluation plus 1 day onsite at Level 1, 1.5 days at Level 2
- Products used as dietary supplements or supplement ingredients: CSQ’s own scope rules require the Dietary Supplement Addendum, available only at Level 2 or 3; that is a CSQ requirement, not a Missouri one
- No certificate mandated: certification is voluntary, independent proof
-
Comprehensive or micro
Dispensary
Retail storage, handling and sale. CSQ Retail is built on current good handling practices: inventory, storage, customer-facing controls and staff training.
- Standard: CSQ Retail v1.0
- Level: Level 1 or higher
- No certificate mandated: certification is voluntary, independent proof
- Minimum audit: 1-day document review plus 1 day onsite at Level 1
-
Deli-style
Dispensary That Packs Flower or Makes Pre-Rolls
Dispensaries that break down and pack bulk flower, grind or blend herbal material, or produce and pack pre-rolls at the point of sale fit CSQ Deli-Style Retail, a version of the CSQ Standard for Retail & Deli-Style Retail (v1.0) that adds cGMP manufacturing controls on top of retail handling. Deli-style does not cover the manufacture of infused products, which belongs to CSQ Manufacturing.
- Standard: CSQ Deli-Style Retail (Retail & Deli-Style Retail standard, v1.0)
- Level: Level 1 or higher; Level 2 adds full HACCP
- Minimum audit: 1-day document evaluation plus 1 day onsite at Level 1
- No certificate mandated: certification is voluntary, independent proof
-
Wholesale · dispensary
Microbusiness
Microbusiness wholesale facilities may grow up to 250 flowering plants (19 CSR 100-1.160(2)(A)1.) and process; micro dispensaries sell. Cover every licensed activity you perform, and ask us how the standards in scope combine into one audit.
- Standard: CSQ Cultivation, Extraction, Manufacturing and/or Retail, to match your activities
- Level: Level 1 or higher; Level 2 adds HACCP
- Minimum audit: 1-day document evaluation plus 1 day onsite at Level 1
- No certificate mandated: certification is voluntary, independent proof
-
ISO/IEC 17025
Testing Laboratory
Labs follow their own lane: Missouri requires testing laboratories to hold ISO/IEC 17025 accreditation from an ILAC-recognized accreditation body within one year of approval to operate (19 CSR 100-1.110(3)(B)). That is the lab’s published standard under the QMS rule; it is not a CSQ or Kiwa ASI service, and Kiwa ASI does not provide laboratory testing.
- Standard: ISO/IEC 17025 accreditation, required by Missouri
- CSQ publishes no laboratory standard
Transport and storage. Missouri has no separate transportation license type; transport and storage duties (19 CSR 100-1.140) sit inside each license, and CSQ’s storage and distribution sections cover them within your standard’s scope. If your products are used as dietary supplements, the Dietary Supplement Addendum attaches only to Level 2 or Level 3 certifications on Cultivation, Extraction or Manufacturing, audited alongside your certification audit or separately once you are certified, never on its own before certification.
What Missouri Requires vs. What CSQ Adds
Missouri’s regulations are the legal floor, and the QMS rule tells you to build a system on top of them with emphasis on regulatory compliance. CSQ is a published cannabis-specific standard that adds verified best practice state law doesn’t spell out. Knowing which is which keeps you from over-buying or under-preparing.
-
The legal floor
What Missouri Requires
- A QMS on a published standard, implemented within one year of approval to operate (19 CSR 100-1.100(4)(D))
- SOPs and practices that keep marijuana product free of contamination: equipment and supply flow, employee health and sanitation, and environmental controls including HEPA filtration under positive pressure for cultivation and manufacturing (100-1.100(4)(L))
- Employee training on eight required topics, completed within one week of starting work, with records kept five years (100-1.080)
- Testing of every lot, including dispensary prerolls (100-1.110(1)(A)), with labs accredited to ISO/IEC 17025 (100-1.110(3)(B))
- Packaging and labeling that protects public health and is not attractive to children (100-1.120)
- Seed-to-sale track-and-trace and inventory control (100-1.130)
- Transportation and storage controls inside each license (100-1.140)
- Secure waste storage with five-year final-disposition records (100-1.150)
- Compliance with department-initiated recalls (100-1.100(4)(P)), plus DCR’s own unannounced sampling (100-1.110(12))
- For manufacturers of ingestibles: food GMPs under 21 CFR 117, checked through the scheduled Cannabis Food Safety inspection lane (19 CSR 100-1.170 and 19 CSR 20)
-
Verified best practice
What CSQ Adds
- An annual certification audit, plus an unannounced audit at least every three years at every level
- A documented internal audit program (CSQ 1.5) and corrective and preventive action with annual trending (1.6)
- A mock recall at least once a year, completed in under two hours (1.8), a CSQ practice Missouri’s rule does not require but DCR-initiated recalls reward
- A risk-based environmental monitoring program for microbial hazards (2A.8)
- Annual ISO/IEC 17025 testing of facility air and water (2A.6, 2A.7)
- Process gases and extraction solvents of at least 99.5% purity unless otherwise specified, CO₂ of beverage grade or better (never medical grade), and non-denatured, food-grade ingredient ethanol (3B.1.5, 3B.1.6, 3C.1.3, 3C.1.4)
- Inhalation-grade ingredients for inhalable products, where food-grade or GRAS alone is not sufficient, plus route-of-administration risk assessments (3C.2)
- Cannabinoid and non-cannabinoid waste streams kept separate (2A.4.1) and contract manufacturers audited (2A.11)
- No lead irrigation components and no untreated manure in cultivation (3A.1.12, 3A.1.7)
- Notice to your certification body within 72 hours of a recall, voluntary withdrawal or regulatory warning
- At Level 2, a HACCP system built on the 12 Codex steps, with one team member and one back-up certified through a course approved by the International HACCP Alliance (4A.1, 4A.2); plain Retail certifies at Level 2 to a basic HACCP module (4B) instead
What a CSQ Audit Looks Like in Missouri
An initial CSQ audit has three parts: a one-day offsite review of your documentation (no more than six months before the site visit), the onsite audit, and the report. Minimum onsite time is 1 day at Level 1, 1.5 days at Level 2 and 2 days at Level 3, plus report time; your actual time depends on the standards in scope and the size of your site. The auditor checks your written system against CSQ and Missouri’s rules (CSQ 1.3, Regulatory Compliance), watches your people work, and samples your records.
CSQ Audit Modules
| Module | What the auditor checks |
|---|---|
| 1 Management system (all levels) | Documented CSQ system with SOPs and a copy of Missouri’s rules, management commitment, regulatory compliance, records, internal audits, CAPA, complaints, recalls and withdrawals, product defense, fraud prevention and crisis management |
| 2A Good manufacturing practices (cultivation, extraction, manufacturing, deli-style) | Facility and infrastructure, equipment and calibration, cleaning and sanitation, waste, integrated pest management, air and water safety, environmental monitoring, storage, inventory and traceability, supplier approval, production and process controls, labeling and packaging, product testing, personnel |
| 2B Good handling practices (CSQ Retail v1.0) | The retail twin of Module 2A: facility, sanitation, storage and temperature control, inventory management, product handling controls, labeling, sampling and personnel, built for dispensary operations |
| 3A / 3B / 3C / 3D / 3E Products and processes (all levels) | Cultivation (3A): water, fertigation, crop maintenance, harvest. Extraction (3B): process gases and solvents, extraction equipment, post-processing. Manufacturing (3C): ingredients, formulation, inhalable, ingestible and topical product controls, homogeneity and dosing. Deli-style retail (3D): herbal-material handling and pre-roll production. Retail (3E): cannabinoid materials and products handled at the dispensary |
| 4A / 4B HACCP (Level 2 and up) | Hazard analysis, critical control points, monitoring, corrective actions, validation and verification. Module 4A (producers and deli-style) also requires a HACCP team with one member and a back-up certified through an IHA-approved course; plain Retail is audited to the basic HACCP module 4B |
| 5 Advanced quality management (Level 3) | Advanced management system requirements, safety and quality culture, customer satisfaction and product realization; Level 3 audits are unannounced |
| Mock recall and traceability | Your annual mock recall record, plus a traceability exercise during the audit |
How CSQ Audits Are Scored
Each audit starts at 100, and every nonconformance deducts points. The final score decides the outcome:
| Result | Score | What happens next |
|---|---|---|
| Certified | 80–100 | Certificate; next annual certification audit in a year |
| Certified with surveillance | 70–79 | Certificate plus a surveillance audit in six months; a score of 79 or below on that audit suspends the certificate |
| Not certified | 0–69 | No certificate; wait six months before reapplying |
Certificates are valid for one year plus 45 days and are listed on CSQ’s public registry, where your wholesale buyers, inspectors and anyone else can look them up.
Nonconformance Categories
-
Critical−100
A requirement that has not been implemented and is a significant risk to product safety and quality. A critical finding fails the audit.
-
Major−10
A deficiency in meeting a CSQ requirement that, if not addressed, will likely lead to a risk to product safety and quality.
-
Minor−1
A deficiency in meeting a CSQ requirement that, if not addressed, may lead to a risk to product safety or quality.
After the audit: the evidence record follows within 7 days, corrective actions must be approved and closed within 30 calendar days of the closing meeting, and the final report and certificate follow within about 45 days. Every certified site also gets an unannounced audit at least once every three years. Agree blackout dates with us for days your operation won’t be running, and submit them no later than 60 days before the unannounced audit window; refusing an unannounced audit suspends the certificate.
Missouri QMS Audit Readiness Checklist
DCR checks QMS compliance the way it checks everything, through compliance officers, inspections and the notice-of-violation process, and a CSQ audit samples the same system. Use this list to check you’re ready before the auditor arrives.
-
Documents
Paperwork to Have Ready
- Your Missouri license, approval-to-operate date and a copy of the rules you follow
- The published standard you chose, and your QMS manual built on it
- SOPs for sanitation, equipment and supply flow, environmental controls, process flow, product release, recalls and complaints
- Supplier approval file, including COAs for CO₂, solvents, ethanol and ingredients
- An organization chart and job descriptions, with training records showing the eight required topics covered within one week of each hire (100-1.080)
-
Records (CSQ recommends 60+ days)
Records You Need Running
- Batch and production records with quality-control review and release
- Cleaning and sanitation logs, pest control reports and equipment calibration records
- Environmental monitoring results and annual air and water test reports
- Lot testing COAs from your ISO/IEC 17025-accredited Missouri lab
- Track-and-trace reconciliations that tie inputs to finished lots, plus your mock recall record
- An internal audit report and a CAPA log showing findings closed
-
CSQ specifics
Cannabis-Specific Items Auditors Check Closely
- Process-gas and CO₂ grade, and food-grade, non-denatured ingredient ethanol
- Inhalation-grade ingredients and route-of-administration risk assessments for formulated, inhalable and topical products
- Potency, homogeneity and dosing controls for infused products
- Cannabinoid waste kept separate from non-cannabinoid waste, with the five-year disposal records Missouri requires
- Labels and packaging checked against Missouri’s child-protection rules before release
- HEPA filtration under positive pressure where 100-1.100(4)(L) requires it
| Missouri requirement | Citation (19 CSR) | Cultivation / Extraction / Manufacturing (Module 2A) | Dispensaries (CSQ Retail v1.0, Module 2B) |
|---|---|---|---|
| QMS implementation | 100-1.100(4)(D) | Level 1 = Modules 1–3 of the matching standard | Retail Level 1 = Modules 1, 2B, 3E |
| SOPs and contaminant-free product | 100-1.100(4)(L) | 1.1 CSQMS General Requirements + 2A.3 Cleaning and Sanitation + 2A.12 Production and Process Controls | 2B.3 Cleaning and Sanitation + 2B.11 Product Handling Controls |
| Temperature and humidity control | 100-1.100(4)(L) | 2A.9.3 Temperature and Atmosphere Controlled Storage | 2B.8.3 Temperature and Atmosphere Controlled Storage |
| Environmental condition monitoring | 100-1.100(4)(L) | 2A.8 Environmental Monitoring | n/a |
| Facility construction (smooth, cleanable) | 100-1.100(4)(L) | 2A.1.1 Facility Construction and Design | 2B.1.1 Facility Construction and Design |
| Employee training | 100-1.080 | 2A.13 Personnel Requirements (2A.13.2 Training) | 2B.12 Personnel Requirements (2B.12.2 Personnel Training) |
| Mandatory product testing | 100-1.110 | 2A.12.9 Product Sampling and Testing | 2B.11.7 Product Sampling and Testing |
| Packaging and labeling | 100-1.120 | 2A.12.8 Product Labeling and Packaging | 2B.11.6 Product Labeling |
| Inventory and seed-to-sale | 100-1.130 | 2A.10 Inventory Management + 1.3 Regulatory Compliance | 2B.9 Inventory Management + 1.3 |
| Transport and storage | 100-1.140 | 2A.9 Storage and Distribution | 2B.8 Storage and Distribution |
| Secure waste, 5-year disposal records | 100-1.150 | 2A.4 Waste Management (2A.4.1 cannabinoid waste separation) | 2B.4 Waste Management |
| Cultivation specifics | 100-1.160 | 3A.1.5–3A.1.16 (water, fertigation, crop maintenance, harvest) | n/a |
| Manufacturing and extraction specifics | 100-1.170 | 3B.1.2–3B.1.9 (gases, ethanol) + 3C.1.3, 3C.1.4, 3C.2.5, 3C.2.6 | n/a |
| Dispensary specifics | 100-1.180 | n/a | 2B.8 + 2B.9 + 2B.11 + 2B.12 + Module 3E (CSQ Retail v1.0) |
Mapping by Kiwa ASI to CSQ Version 2.0 producer standards and CSQ Retail Version 1.0; Missouri names no scheme and no level. Level 1 covers the quality management system the rule asks you to implement. Level 2 adds HACCP, and the Dietary Supplement Addendum, for products used as dietary supplements, attaches only to Level 2 and Level 3 certifications on Cultivation, Extraction or Manufacturing. Ask us which configuration fits your facility.
How to Get CSQ Certified in Missouri
Start early. Most operations need several months to build the system and collect records before the audit, and your one-year implementation clock is already running from the day your facility was approved to operate.
-
01
Step 1: Note Your Clock and Your Lanes
Write down the date your facility received approval to operate: the QMS must be implemented within one year of it. Manufacturers of ingestibles should also note the Cannabis Food Safety inspection lane, which checks food GMPs alongside the QMS rule.
-
02
Step 2: Choose Your Standard, Scope and Level
The rule says the standard must fit your facility type. Match CSQ Cultivation, Extraction, Manufacturing, Retail or a combination to what you do, and choose a level: Level 1 is a complete QMS on a published standard, Level 2 adds HACCP. Products used as dietary supplements need the Dietary Supplement Addendum, a CSQ scope rule, at Level 2 or higher. Request a quote so we can confirm scope and audit time.
-
03
Step 3: Write the System
A QMS manual on your chosen standard, SOPs for every 100-1.100(4)(L) area, batch records, supplier approval, sanitation, environmental monitoring, traceability tied to track-and-trace, recall procedures, document control, internal audit and CAPA. Your program manager also takes CSQ’s online Certification Program Overview course, accessed through the CSQ website.
-
04
Step 4: Train Your Team
Missouri requires training on eight topics within one week of starting work, with records kept five years (100-1.080). Train every person on GMP, hygiene and their own procedures too, and for Level 2 have one HACCP team member and a back-up certified through a course approved by the International HACCP Alliance.
-
05
Step 5: Run It and Audit Yourself
Operate the system, and aim for at least 60 days of records, which CSQ recommends before certification. Run a documented internal audit and a mock recall in under two hours, close what you find through CAPA, and check yourselves against the published standard before the real audit, a step CSQ strongly recommends and one your own team can run.
-
06
Step 6: Schedule With Kiwa ASI
Sign the certification agreement; the audit is scheduled through the CSQ Database. Send your documents for the offsite evaluation, which can happen up to six months before the onsite audit, and pick an onsite date that leaves time for corrective actions.
-
07
Step 7: Close Out and Keep It Current
Close corrective actions within 30 days of the closing meeting and receive your certificate, typically within about 45 days of the audit. Keep it current with the annual recertification audit: a current certificate is standing, independent proof of the QMS Missouri requires you to run.
Worked backward from a January approval to operate: the QMS must be implemented by the following January. Have the system generating records by early spring (CSQ recommends 60 days of records), book the offsite documentation evaluation by early summer, run the 1-day onsite Level 1 audit in late summer, close corrective actions within 30 days, and hold the certificate well before the implementation deadline. A score below 70, or any critical finding, means a six-month wait before reapplying, which is the practical argument for not starting in month ten. If your clock is short, put your date in the form above and we’ll tell you the earliest audit dates we can offer.
Prepare Your Team with Kiwa ASI Training
Live online courses, taught by experienced food safety trainers, for the QMS and GMP disciplines Missouri’s rules expect and the qualifications CSQ asks for. CSQ’s own Certification Program Overview course for your program manager is taken online through CSQ.
HACCP
HACCP Certification Training
IHA-accredited HACCP certification. CSQ Level 2 and 3 on Cultivation, Extraction, Manufacturing and Deli-Style Retail need one HACCP team member and a back-up certified in an IHA-approved course (4A.2).
16 contact hours · 4 half-days · Live via Zoom · 8:30 AM–12:30 PM CT
Upcoming dates$695 per seat
Dates on request. Ask about upcoming dates
Part 117
PCQI Certification Training
The FSPCA Preventive Controls for Human Food course behind 21 CFR Part 117, the food GMP rule Missouri’s Cannabis Food Safety inspection lane draws on.
22 contact hours · 5 half-days · Live via Zoom · 8:30 AM–12:30 PM CT
Upcoming dates$899 per seat
Dates on request. Ask about upcoming dates
Internal Audit
Principles of Internal Auditing
Plan, run and report the internal audits CSQ requires (1.5), and follow up with corrective action (1.6).
Full day · Live online · 8:30 AM–4:30 PM CT
Upcoming dates$499 per seat
Dates on request. Ask about upcoming dates
EMP
Environmental Monitoring Program Training
Design the risk-based environmental monitoring program CSQ requires (2A.8), going beyond the environmental controls 19 CSR 100-1.100(4)(L) names.
Half day · Live online
Upcoming dates$300 per seat
Dates on request. Ask about upcoming dates
Allergens
Allergen Management Training
Allergen risk assessment and cross-contact control for infused edibles and beverages.
4 hours · Live online
Upcoming dates$300 per seat
Dates on request. Ask about upcoming dates
Food Defense
Food Defense Coordinator Training
Threat assessments and a defense plan, supporting CSQ’s product defense and fraud prevention requirements (1.9, 1.10).
Full day · Live online · 8:30 AM–4:30 PM CT
Upcoming dates$499 per seat
Dates on request. Ask about upcoming dates
Need to train 6+ people? Request private training. Training is delivered separately from certification by a different legal entity, and taking a course has no effect on your audit result.
Why Missouri Operators Choose Kiwa ASI
Kiwa ASI has audited food safety and GMP programs for decades and brings the same discipline to Missouri’s cannabis operators, against a standard named as an example in Missouri’s own rule.
-
Accredited
CSQ’s Licensed Certification Body
CSQ certificates are issued by ASI Food Safety, LLC (Kiwa ASI), CSQ’s licensed certification body, which is accredited to ISO/IEC 17065.
-
Named example
A Standard Named in the Rule
CSQ is one of the four example standards 19 CSR 100-1.100(4)(D) names, and it is purpose-built for cannabis operations, with standards covering cultivation, extraction, manufacturing, retail, and warehousing and distribution. Missouri approves no scheme; fit to your facility type is the rule’s own test.
-
St. Louis area
Rooted in Missouri
The CSQ program is owned by ASI Global Standards, LLC of St. Ann, Missouri, in Kiwa ASI’s own St. Louis backyard, so Missouri facilities aren’t a remote market to us.
-
Auditors
Qualified, Impartial Auditors
CSQ auditors need bioscience education (or equivalent work experience), IHA-recognized HACCP training and CSQ lead auditor training, and can’t audit a site they provided consulting to, including delivering training, in the past three years.
-
Integrity
Impartiality, Disclosed
CSQ is owned by ASI Global Standards, LLC, which, like ASI Food Safety, LLC, is part of ASI Holdings. CSQ discloses that relationship and publishes an impartiality statement. Auditors can’t audit a site they provided consulting to, including delivering training, in the past three years, and every report gets an independent technical review before a certificate is issued.
-
Partnership
Global Kiwa Network
Part of Kiwa, a testing, inspection and certification group operating in more than 30 countries. Kiwa ASI audits and certifies; it doesn’t provide laboratory testing.
Frequently Asked Questions About Missouri’s Cannabis QMS Rule
Does Missouri require QMS certification for cannabis businesses?
No. Missouri requires every licensed facility to implement a quality management system using a published standard within one year of receiving approval to operate (19 CSR 100-1.100(4)(D)), but nothing in the rule or in DCR’s guidance requires a certificate, an audit or a level. Certification is voluntary, independent proof that the QMS you must implement actually runs, and it is the cleanest documentation to show an inspector.
What does 19 CSR 100-1.100(4)(D) actually require?
Three things: a quality management system built on a published standard; a standard applicable to your facility type, implemented with emphasis on regulatory compliance; and implementation within one year of the date your facility receives department approval to operate. The grace period for transition-era operators ended December 1, 2023, so the mandate is fully in force for every licensee.
Which QMS standards count under the Missouri rule?
The rule names four example standards, introduced by “such as”: those offered by the International Organization for Standardization, ASTM International, Cannabis Safety and Quality, and the Foundation of Cannabis Unified Standards. The list is illustrative, not exclusive; the rule’s own tests are that the standard is published, fits your facility type and is implemented with emphasis on regulatory compliance. CSQ is purpose-built for cannabis operations, with standards covering cultivation, extraction, manufacturing, retail, and warehousing and distribution.
When is my QMS deadline?
One year from the date your facility receives department approval to operate, written into the rule itself. Approval to operate must in turn come within one year of licensure, or two years for microbusinesses (19 CSR 100-1.100(4)(E)), so new licensees effectively build the QMS during buildout and their first operating year.
What happens if we keep getting violations?
Under 19 CSR 100-1.030(4)(B), a licensee with Initial Notices of Violation covering more than three rules in twelve months, or more than one Initial NOV for the same regulation in twelve months, may be required to acquire certification to a QMS standard chosen by the department, or submit to a third-party audit by an auditor chosen by the department, at the licensee’s expense. DCR’s Path to Compliance Guide repeats it in plain words: the provider is selected by DCR and all costs are yours. Certifying voluntarily means you pick the standard, the level and the timing.
Which CSQ standard fits my Missouri license?
Cultivation facilities use CSQ Cultivation; manufacturing facilities use CSQ Extraction, CSQ Manufacturing or both; dispensaries use CSQ Retail, or CSQ Deli-Style Retail if they pack flower or produce pre-rolls on site; microbusinesses combine the standards that match their activities, and we can confirm how the scopes combine into one audit. Missouri has no separate transportation license type, and transport duties sit inside each license, covered by your standard’s storage and distribution sections. Cultivation, Extraction and Manufacturing are on Version 2.0, in effect since January 2026; Retail & Deli-Style Retail and Warehousing & Distribution are on Version 1.0.
Which CSQ level do I need in Missouri?
Missouri’s rule sets no level. CSQ Level 1 (Modules 1 to 3) is a complete quality management system on a published standard, which is what the rule asks you to implement; Level 1 or higher fits the rule’s facility-type requirement. Level 2 adds a HACCP system, with one team member and a back-up certified through an International HACCP Alliance approved course on Cultivation, Extraction, Manufacturing and Deli-Style Retail, while plain Retail certifies to a basic HACCP module; Level 3 adds advanced quality management with unannounced audits. If your products are used as dietary supplements, CSQ’s own scope rules require the Dietary Supplement Addendum, which is available only at Level 2 or higher on Cultivation, Extraction or Manufacturing; that is a CSQ requirement, not a Missouri one.
Do dispensaries and microbusinesses need a QMS too?
Yes, the implementation rule applies to every licensed facility type. A dispensary’s QMS lives in handling, storage, inventory and training disciplines, which is what CSQ Retail (built on current good handling practices) covers; microbusinesses cover whichever activities they are licensed for. The certificate itself stays voluntary for all of them.
What is Missouri’s Cannabis Food Safety inspection program?
A scheduled inspection lane DCR introduced in 2026 for manufacturers of ingestible products, checking food GMPs, 21 CFR 117, adopted through 19 CSR 20 and applied to cannabis manufacturing by 19 CSR 100-1.170. DCR says the program introduces no new requirements. It runs alongside the QMS rule, and a QMS built on a standard with GMP content addresses both disciplines at once, though no certification substitutes for the state’s own inspection.
How long does CSQ certification take in Missouri?
Most operations need several months to build the system and collect records; CSQ recommends at least 60 days (two months) of records before attempting certification. The audit itself is a 1-day offsite documentation evaluation, up to six months before the onsite visit, plus 1 day onsite minimum at Level 1 or 1.5 days at Level 2. Corrective actions close within 30 days, and the final report and certificate follow within about 45 days of the audit.
How much does CSQ certification cost in Missouri?
There’s no single price. Audit time drives the fee: your CSQ level (1, 1.5 or 2 days onsite minimum), the standards in scope, the number of employees and product types, the 1-day document evaluation on initial audits, the Dietary Supplement Addendum where it applies, the number of sites and travel. Request a quote for your Missouri scope.
How often do I need to be audited?
Once a year. A CSQ certificate is valid for one year plus 45 days, so the annual recertification audit keeps it current. A score of 70–79 adds a surveillance audit about six months later, and a score of 79 or below on that audit suspends the certificate. Every certified site also gets an unannounced audit at least once every three years.
What happens if we fail the audit?
A score below 70, or any critical finding, means no certificate and a six-month wait before reapplying, so plan for one solid attempt. A score of 70–79 still earns a certificate with a surveillance audit six months later. Corrective actions from any audit must be approved and closed within 30 calendar days of the closing meeting.
Can a brand-new facility get certified before opening?
CSQ provides for a provisional six-month certificate where local licensing requires an audit before operations begin and production records don’t yet exist, with a full audit following around the six-month mark. Missouri doesn’t require a pre-opening audit, so whether the provisional route is available to a Missouri facility that simply wants certification early in its one-year implementation window is a scoping question: ask us.
Why does a QMS matter in Missouri right now?
Because the enforcement record keeps pointing at process failures. Missouri issued four product recalls in 2026 alone, for failed pathogen testing, synthetically derived cannabinoids, and testing done at the wrong production stage, and DCR has pulled its own samples during unannounced visits since mid-2025. In 2023, the state recalled roughly 60,000 products from one manufacturer and ultimately revoked its license over systemic tracking and testing failures. Labeling control, testing sequence and traceability are exactly the disciplines a QMS systematizes.
How does Missouri treat hemp-derived intoxicating products?
Missouri’s Intoxicating Cannabinoid Control Act (2026) directs that intoxicating hemp-derived cannabinoid products be treated like marijuana and handled only by DHSS-licensed facilities, which are subject to the same QMS rule. Key provisions phase in from late 2026 and a federal court challenge is pending, so confirm the current status with DCR before relying on it. For hemp operators entering the licensed system, the practical effect is inheriting the one-year QMS clock, and CSQ covers cannabis and hemp cannabinoid operations alike.
Does Kiwa ASI training affect my CSQ audit?
No. Training and certification are kept separate: certification audits are delivered by ASI Food Safety, LLC, the certification body, while training is delivered separately by a different legal entity, and taking a course has no effect on your audit result. An auditor, technical reviewer or certification decision maker can’t work on your certification if they provided consulting, including delivering training, to your operation in the past three years.
Who issues CSQ certificates, and are they accredited?
CSQ certificates are issued by ASI Food Safety, LLC, the company behind the Kiwa ASI brand and CSQ’s licensed certification body, which is accredited to ISO/IEC 17065. CSQ itself is a standard, so it isn’t accredited, and it isn’t GFSI-benchmarked. Certificates are listed on CSQ’s public registry, where anyone can verify them.
Ready to put your Missouri QMS on the record?
Tell us your license type, what you make and your approval-to-operate date. We’ll recommend a CSQ standard and level, quote your audit and tell you the earliest audit dates we can offer.
Standards & Trust
ASI Food Safety, LLC (Kiwa ASI) is currently CSQ's licensed certification body and is accredited to ISO/IEC 17065. CSQ is a standard, so it isn't itself accredited, and it isn't GFSI-benchmarked. Missouri names four example standards and requires implementation, not certification; it approves no scheme and adjudicates no levels. CSQ is owned by ASI Global Standards, LLC, which, like ASI Food Safety, is part of ASI Holdings (see CSQ’s program oversight and impartiality statement). Kiwa ASI training is delivered separately from certification.