Live instructor-led training is 20% off through December 31, 2026 Live training is 20% off through Dec 31 Code: sweaterweather20 View courses
Phone hotline 1 (800) 477-0778 · US.Info@kiwa-asi.com
Kiwa ASI
Nearly a century of food safety expertise, headquartered in St. Louis.
Audits & Inspections
Independent second- and third-party audits for facilities at every stage.
Not sure which audit you need? Answer a few questions and see what fits. It takes about a minute.
Try the Audit Finder →cGMP Audits
Sector-specific Good Manufacturing Practice audits.
GFSI Certification
GFSI-benchmarked programs accepted by major retailers worldwide.
Not sure which audit you need? Answer a few questions and see what fits. It takes about a minute.
Try the Audit Finder →Cannabis Certification
Prove product safety in cultivation, extraction and manufacturing.
Cosmetics Certification
GMP for the cosmetics industry, including MoCRA readiness.
Dietary Supplement Certification
Go beyond basic GMPs with GFSI-benchmarked quality management.
CSR & Sustainability
Certifications for sourcing, allergens and environmental claims.
Food & Beverage
Find your sector. The tag shows the program most of our clients in that sector certify to.
ProcessingProgram
Ingredients & BeverageProgram
Cannabis
CSQ, GMP and state-specific regulatory audits.
Certification
State programs
In every tier, CSQ certification is an independent way to prove your program.
Regulatory QMS
Not sure which program your license requires? Our team maps state rules to the right audit.
Talk to a cannabis specialist →Cosmetics
GMP verification for beauty and personal-care manufacturers.
Dietary Supplements
FDA 21 CFR 111 compliance and GFSI-level quality.
Live Instructor-Led Training
Virtual classes led by Kiwa ASI instructors.
SQF Edition 10
FDA & Regulatory
Hazards & Controls
Live Trainings in St. Louis
In-person classes at our St. Louis headquarters.
Online Self-Paced Training
Short courses built by Kiwa ASI. Train anytime, on any device.
Frontline · $25 a seat
QA & Management · $499
Team training? Volume pricing from $12 a seat on the 30-minute frontline courses.
See volume pricing →Free Webinars
A 6-part 2026 series on SQF Edition 10, supplier management and compliance.
Resources
Articles, answers and media from the Kiwa ASI team.
Forms
Order certification banners or submit feedback.
Show Me Food Safety Scholarship
Supporting the next generation of food safety professionals.
New York requires cannabis processors to pass a qualified third-party GMP audit within one year of commencing licensed operations (9 NYCRR 123.6), and hemp extractors and manufacturers need GMP certification before their license issues. Kiwa ASI is on OCM’s approved GMP auditor lists for adult-use cannabis and cannabinoid hemp, and we audit to CSQ (Cannabis Safety & Quality), a cannabis- and hemp-specific GMP standard developed from the 21 CFR Part 111 and 117 rules New York names.
Last updated October 22, 2026
Tell us your license type, what you make, and when you commenced (or plan to commence) licensed operations, or your hemp provisional approval date. We’ll confirm your CSQ standard and level and tell you the earliest audit dates we can offer against your deadline.
If you extract, infuse, blend or manufacture cannabis or cannabinoid hemp products in New York, almost certainly yes. New York requires all cannabis processing to follow good manufacturing practices (GMP) under 21 CFR Part 111 or Part 117, depending on the product (9 NYCRR 123.6(a)(1)), and OCM’s guidance is blunt: there are no exceptions to processing cannabis under GMP. On top of that, you must prove it with an independent audit. Here is the short version.
Under 9 NYCRR 123.6(a)(2) and OCM’s GMP Audit Guidance (§3), OCM may grant Type 3 processors and microbusinesses a conditional, revocable exemption from the third-party audit (not from GMP) for packaging, labeling and branding of whole flower, non-infused pre-rolls made from pre-ground flower, or kief pressed into pucks, with no grinding on site. You need OCM’s prior written approval: email form OCM-05008 (PDF) to compliance@ocm.ny.gov with the subject “GMP Conditional Exemption Application”. Apply early, because the audit requirement still applies until OCM approves the exemption in writing. Grinding never qualifies, and adding any other processing activity brings the audit back.
Adult-use processors, and microbusinesses, cooperatives and registered-organization adult-use licensees (ROD and ROND) to the extent they process (9 NYCRR 123.12(a)(2), 123.14(a), 123.16(a)(1), 123.18(a)(1)). Medical registered organizations that extract or manufacture carry a parallel duty (9 NYCRR 113.12(d)(2)), and so do cannabinoid hemp processors licensed for extracting and manufacturing or manufacturing only. Cultivators that don’t process, distributors and dispensaries aren’t subject to the audit.
Within one year of commencing licensed operations for adult-use processors and medical registered organizations (9 NYCRR 123.6(a)(2), 113.12(d)(2)). For hemp extractors and manufacturers it is a licensing gate: proof or a plan at application, and the GMP certification filed within six months of provisional approval, before the license issues and before you extract or manufacture (9 NYCRR 114.2(b)(9), 114.4(f)–(g)).
21 CFR Part 111 or Part 117. OCM says the choice depends mainly on intended use: products designed to supplement the diet, such as capsules and tinctures, align with Part 111, and human food with Part 117. Hemp products must be made under 21 CFR Part 101, 111 or 117 as appropriate (9 NYCRR 114.8(a)(1)), and OCM’s hemp guidance ties food-marketed products to Part 117 and supplement-marketed products to Part 111.
OCM decides which third-party GMP auditors are authorized and qualified (9 NYCRR 123.6(a)(2)), and it accepts a GMP audit only when an auditor on its authorized list performs it. OCM guidance adds that the audit must be done by an accredited, third-party certification body. Kiwa ASI is on the New York Office of Cannabis Management’s list of Approved Adult Use Cannabis GMP Auditors (PDF) and on its list of approved cannabinoid hemp GMP auditors (PDF).
The rule counts one year from the day you commence licensed operations, the date on the operations attestation you file with OCM Compliance. OCM’s own compliance reminders count from the day you receive your license, so plan from your license date to be safe, and confirm your date with compliance@ocm.ny.gov. A typical plan for a new adult-use processor looks like this:
Hemp extractors and manufacturers work to a shorter clock: the GMP certification must be filed within six months of provisional approval, before the license issues and before you extract or manufacture, though more time may be requested (9 NYCRR 114.4(f)–(g)). See the hemp FAQ below and talk to us early about timing.
Start your plan the day you receive your license. The rule’s clock starts when you commence licensed operations and file the operations attestation with OCM; that date can come later, so counting from your license date leaves you margin.
Write your product quality plans, SOPs and records, train your people, approve your suppliers and start sanitation and environmental monitoring records.
CSQ recommends at least 60 days of records before certification. Run an internal audit and a mock recall, and close what you find through corrective action.
Request a quote and sign the certification agreement. The 1-day offsite document review can happen up to six months before the onsite audit.
Level 1 is at least 1 day onsite, Level 2 at least 1.5 days. Aim for months 6 to 8 so there’s time to finish before the deadline.
Close corrective actions within 30 days of the closing meeting, receive your certificate, and email it to OCM.
Plan for one attempt. Certificates usually follow the audit by about six weeks, sometimes longer. A score below 70, or any critical finding, means no certificate and a six-month wait before you can reapply, which will usually push you past the one-year deadline. A score of 70–79 still earns a certificate, but you’ll have a surveillance audit about six months later, and a score of 79 or below on that audit suspends the certificate, which puts your proof of current GMP certification at risk. If your deadline is close, put your date in the form above and we’ll tell you the earliest audit dates we can offer.
Passing the audit is only half the job. OCM needs to see the result, and it expects you to stay certified for as long as you hold the license.
Email your GMP audit certificate to compliance@ocm.ny.gov with your license number and “GMP Audit Certificate” in the subject line, as OCM’s GMP FAQ (PDF) asks. Medical registered organizations should include the full audit report, because 9 NYCRR 113.12(d)(2) asks for any related certification or audit report; adult-use licensees should keep it ready in case OCM requests it. Hemp applicants file the certification with their licensing submission; ask hemp@ocm.ny.gov if you’re unsure where it goes.
Keep proof of current GMP certification for the whole license term, ready to show OCM on request (9 NYCRR 123.6(a)(3)). A CSQ certificate is valid for one year plus 45 days, so the annual recertification audit keeps you current. Book it well before your certificate expires: CSQ allows extensions only in extreme circumstances such as fire, severe weather or a pandemic, and a lapsed certificate is no longer current.
OCM guidance requires an updated GMP audit or certification at each two-year license renewal. Adult-use renewals are filed 120 to 60 days before the license expires (9 NYCRR 120.11). Have a current certificate in hand when you file.
OCM’s routine compliance inspections are generally unannounced and include GMP production standards. Findings come in a statement of findings, with a corrective action plan due within 15 calendar days, or 24 hours for critical findings (9 NYCRR 133.5).
Match what you actually do to the CSQ standard that covers it. If you hold more than one authorization, the standards in scope are audited together in one coordinated audit. New York doesn’t name a CSQ level; the readiness checklist below shows what each level covers.
CO₂, ethanol, hydrocarbon or solventless extraction, concentration and refinement. New York sets minimum input grades in 9 NYCRR 123.6(c): closed-loop CO₂ of at least 99.5% purity, and butane and propane of at least 99% with a COA. CSQ Extraction sets a higher bar: process gases including butane and propane, and solvents such as ethanol, of at least 99.5% purity unless otherwise specified, and CO₂ of beverage grade or better.
Edibles, beverages, tinctures, capsules, vape cartridges, topicals and other infused products, measured against 21 CFR Part 117 or Part 111 by intended use.
Type 3 processors and microbusinesses limited to packaging, labeling and branding of flower, non-infused pre-rolls or kief pucks may apply for OCM’s conditional exemption. If you grind, or don’t have the exemption, plan for the audit.
Vertically integrated operators carry processor duties to the extent they process. Cover your processing scope, and add CSQ Cultivation if you want the grow certified too.
Registered organizations that extract or manufacture need a qualified third-party GMP audit within one year of commencing operations, kept current for the registration.
Extracting and manufacturing, or manufacturing-only, hemp licenses need GMP certification before the license issues. Farm processors (flower products only, no extraction) don’t need the third-party audit but must still follow GMP.
Supplement-type products. If OCM measures your product against 21 CFR Part 111, CSQ’s Part 111-specific controls (master production and batch records, botanical identity, reserve samples) sit in the Dietary Supplement Addendum, which needs CSQ Level 2 or 3. It can be audited alongside your initial CSQ audit or added later, but never on its own before CSQ certification. Cultivators without a processor license aren’t subject to the audit, but CSQ Cultivation is available as a voluntary certification.
New York’s regulations are the legal floor. CSQ is a published cannabis and hemp standard built on 21 CFR Part 111 and 117 cGMP that adds cannabis- and hemp-specific requirements state law doesn’t have. Knowing which is which keeps you from over-buying or under-preparing.
An initial CSQ audit has three parts: a one-day offsite review of your documentation (no more than six months before the site visit), the onsite audit, and the report. Minimum onsite time is 1 day at Level 1, 1.5 days at Level 2 and 2 days at Level 3, plus report time; your actual time depends on the standards in scope and the size of your site. The auditor checks your written system against CSQ and New York’s rules (CSQ 1.3, Regulatory Compliance), watches your people work, and samples your records.
| Module | What the auditor checks |
|---|---|
| 1 Management system (all levels) | Documented CSQ system with SOPs and a copy of New York’s rules, management commitment, regulatory compliance, records, internal audits, CAPA, complaints, recalls and withdrawals, product defense, fraud prevention and crisis management |
| 2A Good manufacturing practices (all levels) | Facility and infrastructure, equipment and calibration, cleaning and sanitation, waste, integrated pest management, air and water safety, environmental monitoring, storage, inventory and traceability, supplier approval, production and process controls, labeling and packaging, product testing, personnel |
| 3B / 3C Cannabinoid products and processes (all levels) | Extraction (3B): process gases and solvents, extraction equipment, post-processing. Manufacturing (3C): ingredients, formulation, inhalable, ingestible and topical product controls, homogeneity and dosing |
| 4A HACCP (Level 2 and up) | Multidisciplinary HACCP team with one member and a back-up certified through an IHA-approved course, hazard analysis, critical control points, monitoring, corrective actions, validation and verification |
| 5 Advanced quality management (Level 3) | Advanced management system requirements, safety and quality culture, customer satisfaction and product realization; Level 3 audits are unannounced |
| Mock recall and traceability | Your annual mock recall record, plus a traceability exercise during the audit |
Each audit starts at 100, and every nonconformance deducts points. The final score decides the outcome:
| Result | Score | What happens next |
|---|---|---|
| Certified | 80–100 | Certificate; next annual certification audit in a year |
| Certified with surveillance | 70–79 | Certificate plus a surveillance audit in six months; a score of 79 or below on that audit suspends the certificate |
| Not certified | 0–69 | No certificate; wait six months before reapplying |
Certificates are valid for one year plus 45 days and are listed on CSQ’s public registry, where anyone can look them up.
A requirement that has not been implemented and is a significant risk to product safety and quality. A critical finding fails the audit.
A deficiency in meeting a CSQ requirement that, if not addressed, will likely lead to a risk to product safety and quality.
A deficiency in meeting a CSQ requirement that, if not addressed, may lead to a risk to product safety or quality.
After the audit: the evidence record follows within 7 days, corrective actions must be approved and closed within 30 calendar days of the closing meeting, and the final report and certificate follow within about 45 days. Every certified site also gets an unannounced audit at least once every three years. Agree blackout dates with us for days your operation won’t be running, and submit them no later than 60 days before the unannounced audit window; refusing an unannounced audit suspends the certificate.
OCM’s GMP audit guidance (PDF) says GMP audits typically cover six areas: management commitment, risk management, quality management systems, site and facility management, product controls and staff training. Use this list to check you’re ready before the auditor arrives.
| OCM GMP audit area | CSQ section | CSQ level |
|---|---|---|
| Complaint management | 1.7 | Level 1 |
| Regulatory compliance | 1.3 | Level 1 |
| Document control and record-keeping | 1.4 | Level 1 |
| Internal audits | 1.5 | Level 1 |
| Corrective and preventive actions | 1.6 | Level 1 |
| Recall program | 1.8 | Level 1 |
| Crisis management | 1.11 | Level 1 |
| Equipment and utensils | 2A.2 | Level 1 |
| Cleaning and sanitation | 2A.3 | Level 1 |
| Waste management | 2A.4 | Level 1 |
| Pest control | 2A.5 | Level 1 |
| Air safety and quality | 2A.6 | Level 1 |
| Water safety and quality | 2A.7 | Level 1 |
| Environmental monitoring | 2A.8 | Level 1 |
| Storage and distribution controls | 2A.9 | Level 1 |
| Chemical controls | 2A.9 | Level 1 |
| Product identification and traceability | 2A.10 | Level 1 |
| Hold and release controls | 2A.10 | Level 1 |
| Supplier controls | 2A.11 | Level 1 |
| Allergen management | 2A.12 | Level 1 |
| Packaging and labeling controls | 2A.12 | Level 1 |
| Product testing | 2A.12 | Level 1 |
| Personnel practices | 2A.13 | Level 1 |
| Employee training | 2A.13 | Level 1 |
| HACCP | 4A | Level 2 |
| Risk-based preventive controls | 4A (hazard analysis) | Level 2 |
| Verification and validation | 4A | Level 2 |
Mapping by Kiwa ASI to CSQ Manufacturing and Extraction Version 2.0; OCM names no scheme and no level. Level 1 covers 24 of the 27 areas. HACCP, risk-based preventive controls and full verification and validation come with Level 2’s HACCP module. Ask us which level fits your products.
Start early. Most operations need several months to build the system and collect records before the audit, and the one-year clock doesn’t pause.
Adult-use processor, microbusiness, registered organization or hemp processor? Note your license date and your operations attestation date, decide whether each product falls under 21 CFR Part 111 or 117, and check whether the packaging-only exemption could apply.
Match CSQ Extraction, Manufacturing or both to what you do, choose Level 1 or Level 2, and ask us whether your Part 111 products need the Dietary Supplement Addendum (Level 2 or 3 only). Request a quote so we can confirm scope and audit time.
Product quality plans, SOPs, batch records, supplier approval, sanitation, environmental monitoring, traceability and recall procedures, document control, internal audit and CAPA. Your program manager also takes CSQ’s online Certification Program Overview course.
Train every person on GMP, hygiene and their own procedures, and keep the records. For Level 2, have one HACCP team member and a back-up certified through a course approved by the International HACCP Alliance.
Operate the system and collect at least 60 days of records, run a documented internal audit and a mock recall in under two hours, and close what you find through CAPA.
Sign the certification agreement and send your documents for the offsite review. Pick an onsite date that leaves time for corrective actions and the certificate before your deadline.
Close corrective actions within 30 days of the closing meeting and receive your certificate. Adult-use licensees and registered organizations email it to compliance@ocm.ny.gov; hemp applicants file it with their licensing submission. Then keep it current with annual recertification.
Live online courses, taught by experienced food safety trainers, for the GMP knowledge New York’s 21 CFR Part 111 and 117 rules expect and the qualifications CSQ asks for. CSQ’s own Certification Program Overview course for your program manager is taken online through CSQ.
The FSPCA Preventive Controls for Human Food course behind 21 CFR Part 117, for edible and beverage makers.
22 contact hours · 5 half-days · Live via Zoom · 8:30 AM–12:30 PM CT
Dates on request. Ask about upcoming dates
One day on current Good Manufacturing Practices for the people who run your floor every day.
8 contact hours · 1 full day · Live via Zoom · 8:30 AM–4:30 PM CT
Dates on request. Ask about upcoming dates
IHA-accredited HACCP certification. CSQ Level 2 and 3 need one HACCP team member and a back-up certified in an IHA-approved course (4A.2).
16 contact hours · 4 half-days · Live via Zoom · 8:30 AM–12:30 PM CT
Dates on request. Ask about upcoming dates
Plan, run and report the internal audits CSQ requires (1.5), and follow up with corrective action (1.6).
Full day · Live online · 8:30 AM–2:30 PM CT
Dates on request. Ask about upcoming dates
Design the risk-based environmental monitoring program CSQ requires (2A.8), beyond New York’s temperature and humidity checks.
Half day · Live online
Dates on request. Ask about upcoming dates
Allergen risk assessment and cross-contact control for infused edibles and beverages.
4 hours · Live online
Dates on request. Ask about upcoming dates
Threat assessments and a defense plan, supporting CSQ’s product defense and fraud prevention requirements (1.9, 1.10).
Full day · Live online · 8:30 AM–2:30 PM CT
Dates on request. Ask about upcoming dates
Need to train 6+ people? Request private training. Training is delivered by ASI Training and Consulting, LLC, separately from certification, and taking a course has no effect on your audit result.
Kiwa ASI has audited food safety and GMP programs for decades and brings the same discipline to New York’s cannabis and hemp processors, under the federal food and supplement GMP rules New York uses.
On OCM’s approved cannabinoid hemp GMP auditor list since 2021 and its adult-use list since 2024. OCM approves auditors, not certification schemes: New York doesn’t name or approve CSQ or any other private standard.
CSQ certificates are issued by ASI Food Safety, LLC (Kiwa ASI), CSQ’s licensed certification body, which holds ANAB accreditation to ISO/IEC 17065.
New York operators hold more than half of the listings on CSQ’s public registry (October 2026).
CSQ auditors need bioscience education, IHA-recognized HACCP training and CSQ lead auditor training, and can’t audit a site they provided consulting to, including delivering training, in the past three years.
CSQ is owned by ASI Global Standards, LLC, which, like ASI Food Safety, LLC, is part of ASI Holdings. CSQ discloses that relationship and publishes an impartiality statement. Auditors can’t audit a site they provided consulting to, including delivering training, in the past three years, and every report gets an independent technical review before a certificate is issued.
Part of Kiwa, a testing, inspection and certification group operating in more than 30 countries. Kiwa ASI audits and certifies; it doesn’t provide laboratory testing.
Yes, for licensees that process. Adult-use processors must submit proof of a qualified third-party GMP audit of their extraction and/or manufacturing within one year of commencing licensed operations and keep proof of current GMP certification for the license term (9 NYCRR 123.6(a)(2)–(3)). Microbusinesses, cooperatives, RODs and RONDs carry the same duty to the extent they process, medical registered organizations carry a parallel one-year duty (9 NYCRR 113.12(d)(2)), and cannabinoid hemp extractors and manufacturers need GMP certification before their license issues.
Cultivators that don’t hold a processor license, distributors and retail dispensaries aren’t subject to the third-party GMP audit. Hemp farm processors, which may make flower products only with no extraction, don’t need the audit but must still follow GMP. Type 3 processors and microbusinesses limited to packaging, labeling and branding of flower, non-infused pre-rolls or kief pucks, with no grinding, can apply for OCM’s conditional exemption from the audit.
The regulation counts one year from the day you commence licensed operations, the date on the operations attestation you file with OCM. OCM’s compliance reminders count one year from receiving your license, so plan from your license date and confirm your date with compliance@ocm.ny.gov. Aim for the onsite audit around months six to eight so there’s time for corrective actions and the certificate.
For adult-use processors and medical registered organizations, OCM hasn’t published a GMP-specific penalty or extension process. Its routine inspections are generally unannounced and include GMP production standards; findings lead to a corrective action plan due in 15 calendar days, or 24 hours for critical findings, and violations can lead to penalties up to suspension, revocation or non-renewal (9 NYCRR 133.4, 133.5). If you’re late, book the audit now, tell OCM Compliance in writing when it’s scheduled, and don’t leave it until renewal. Hemp applicants are different: they can ask for more time under 9 NYCRR 114.4(g).
Email your GMP audit certificate to compliance@ocm.ny.gov with your license number and “GMP Audit Certificate” in the subject line, as OCM’s GMP FAQ asks. Medical registered organizations should include the full audit report too, because 9 NYCRR 113.12(d)(2) asks for any related certification or audit report; adult-use licensees should keep the full report ready in case OCM requests it. Hemp applicants file the certification with their licensing submission.
Yes. Kiwa ASI (listed by OCM as “Kiwa ASI LLC”) is on OCM’s list titled “Adult Use Licensees and Registered Organizations: Approved Adult Use Cannabis GMP Auditors” and on its list of approved cannabinoid hemp GMP auditors. For adult-use processors, OCM accepts a GMP audit only when an auditor on its authorized list performs it. OCM approves auditors, not schemes, so New York doesn’t name or approve CSQ or any other private standard.
New York requires GMP under 21 CFR Part 111 or Part 117 as applicable to the product (9 NYCRR 123.6(a)(1)). OCM says the choice depends mainly on intended use: products designed to supplement the diet, such as capsules, tinctures or similar ingestible forms, align with Part 111, and human food with Part 117. Hemp products must be made under Part 101, 111 or 117 as appropriate (9 NYCRR 114.8(a)(1)).
No. New York requires a qualified third-party GMP audit by an OCM-authorized auditor, and OCM guidance says it must be done by an accredited, third-party certification body. It doesn’t name CSQ or any other private scheme. Kiwa ASI, an OCM-approved auditor, audits New York processors to CSQ, a cannabis- and hemp-specific GMP standard developed from 21 CFR Part 111 and 117, and CSQ certificates are issued by ASI Food Safety, LLC (Kiwa ASI), CSQ’s licensed certification body, which holds ANAB accreditation to ISO/IEC 17065.
OCM doesn’t name a CSQ level, so it depends on your products. By Kiwa ASI’s mapping, CSQ Level 1 (GMP) addresses 24 of the 27 areas OCM’s guidance says GMP audits typically include. Level 2 adds CSQ’s HACCP module, which is where CSQ addresses OCM’s HACCP, risk-based preventive controls and verification and validation areas; that is a HACCP plan, not a 21 CFR Part 117 food safety plan. Products marketed as dietary supplements need Level 2 or 3 plus CSQ’s Dietary Supplement Addendum. Tell us what you make and we’ll recommend a level for your cannabis or hemp operation.
Extraction, including refining, formulating and packing concentrates and other cannabinoid substances, uses CSQ Extraction. Making and packing finished products such as edibles, beverages, pre-rolls and topicals uses CSQ Manufacturing. Many New York processors hold both, audited together, and we confirm the right scope when you request a quote. Medical registered organizations and hemp processors use the standard that matches their activity, and cultivators can add CSQ Cultivation voluntarily. CSQ Cultivation, Extraction and Manufacturing are on Version 2.0, in effect since January 2026.
Your next recertification audit is to CSQ Version 2.0, in effect since January 2026. Under CSQ’s transition, CSQ GMP moves to Level 1 and CSQ GMP+ moves to Level 2, and the old 21 CFR 111 Addendum is now the Dietary Supplement Addendum, which needs Level 2 or 3. Book the audit well before your current certificate expires so your proof of current GMP certification for OCM doesn’t lapse.
The licensee that extracts or manufactures carries the audit for those processes (9 NYCRR 123.6(a)(2)), and when several processors appear on a label, one must be named as the Manufacturer (9 NYCRR 128.5(b)(5)). If your license only brands products another processor makes, OCM hasn’t set a clear rule on whether you need your own audit, so confirm with compliance@ocm.ny.gov before you rely on your processor’s audit. If you’re CSQ certified, CSQ requires you to make sure your contract manufacturers meet the applicable CSQ requirements through a second- or third-party audit (CSQ 2A.11).
With CSQ, once a year. A CSQ certificate is valid for one year plus 45 days, so an annual certification audit keeps you current. New York itself asks you to keep current GMP certification for the license term (9 NYCRR 123.6(a)(3)), and OCM guidance requires an updated audit or certification at each two-year license renewal. A score of 70–79 adds a surveillance audit about six months later, and a score of 79 or below on that audit suspends the certificate. Every certified site also gets an unannounced audit at least once every three years.
Extracting and manufacturing, and manufacturing-only, applicants must file a copy of their qualified third-party GMP certification before the license issues and before they extract or manufacture. They have six months from provisional approval to do it, though they may ask for more time (9 NYCRR 114.4(f)–(g)). At application, they show proof of a third-party GMP audit or a plan to get one within six months of approval (9 NYCRR 114.2(b)(9)). Farm processor applicants (flower products only, no extraction) don’t need to show this audit evidence, but they must still follow GMP. Where a licensing rule requires an audit before you can operate, CSQ allows a 6-month provisional certificate followed by a full audit. Only OCM can say whether it meets 9 NYCRR 114.4(f), so confirm with hemp@ocm.ny.gov before you rely on it.
New York still requires GMP for hemp processors: OCM says the federal hemp law doesn’t replace New York’s program. Federally, products containing cannabinoids the plant can’t naturally produce fall outside the hemp definition from November 12, 2026, and the full new definition, including a 0.4 mg total THC per container cap, applies from December 11, 2026 (as of October 2026). Watch OCM for New York’s response.
No. State-licensed medical marijuana moved to Schedule III in April 2026, but the federal rule adds no GMP requirement. Adult-use cannabis remains Schedule I, and broader federal rescheduling is still pending. New York’s GMP audit duty comes from state rules: 9 NYCRR 123.6 for adult-use processors and 9 NYCRR 113.12(d)(2) for medical registered organizations.
There’s no single price. Audit time drives the fee: your CSQ level (1, 1.5 or 2 days onsite minimum), the standards in scope, the Dietary Supplement Addendum, the 1-day document review on initial audits, the number of sites and travel. Most operations need several months to prepare, and certificates usually follow the audit by about six weeks. Request a quote for your New York scope.
No. Training and certification are kept separate. CSQ certification audits are delivered by ASI Food Safety, LLC, the certification body. Training is delivered by ASI Training and Consulting, LLC, separately from certification, and taking a course has no effect on your audit result. CSQ lists delivering training as a possible consulting activity, and an auditor, technical reviewer or certification decision maker can’t work on your certification if they provided consulting to your operation in the past three years.
Tell us your license type, what you make and your deadline. We’ll recommend a CSQ standard and level, quote your audit and tell you the earliest audit dates we can offer.
Kiwa ASI is on the New York Office of Cannabis Management’s list of Approved Adult Use Cannabis GMP Auditors (PDF) and on its list of approved cannabinoid hemp GMP auditors (PDF). ASI Food Safety, LLC (Kiwa ASI) is currently CSQ's licensed certification body and holds ANAB accreditation to ISO/IEC 17065. CSQ is a standard, so it isn't itself accredited, and it isn't GFSI-benchmarked. CSQ is owned by ASI Global Standards, LLC, which, like ASI Food Safety, is part of ASI Holdings (see CSQ’s program oversight and impartiality statement). Kiwa ASI training is delivered separately from certification.