Guide to Regulating Industry Standards









PDF Version Available


As states continue to introduce laws providing patients with access to medical cannabis, now more than ever patients, caregivers and health care providers are looking for a way to secure reliable, high-quality medical cannabis products. In 2011, Americans for Safe Access (ASA) began to work with the American Herbal Products Association (AHPA), the principal U.S. trade association and voice of the herbal products industry since 1982, to bring their knowledge and expertise to the medical cannabis industry.

The first step in this work was to bring medical cannabis industry members from around the country together forming AHPA’s Cannabis Committee to create a series “recommendations for regulators.” These recommendations provide regulators with standards to regulate the medical cannabis industry in the areas of 1) manufacturing, packaging and labeling; 2) ana- lytics; 3) dispensary operations; and 4) cultivation. ASA’s decade long experience in drafting legislation, developing regulations, and educating and training medical cannabis providers combined with AHPA’s 30-year history of developing standards for the herbal products indus- try results in the knowledge and expertise to evaluate the quality of medical cannabis prod- ucts and distribution systems.

Based on the AHPA standards, ASA’s Patients First Certification Program (PFC) offers a non- profit, third party certification program for the medical cannabis industry on which patients, caregivers, health care providers, companies and governments can depend. PFC is the nation’s only certification program for the AHPA standards and is available to all companies cultivating, manufacturing or distributing medical cannabis products, as well as to laborato- ries providing analytic services to these companies.

Because ASA is a non-profit organization, all precedes from the program fund activities that further mission, to ensure safe and legal access to cannabis (marijuana) for therapeutic uses and research. Distribution of funds from the Americans for Safe Access Foundation support:

  • Community Support and Patients’ Rights Projects
  • Local Grass Roots Development
  • Outreach to Patients, Health Care Providers, Legislators and Regulators
  • Scientific Research and Complementary and Alternative Medicine Projects

PFC includes employee training, compliance inspections, ongoing monitoring, an independent complaint process for consumers, government relations and marketing support and use of the PFC logo.

The PFC program is currently offered as a voluntary certification program for all medical cannabis states and is a permitted education provider for the District of Columbia’s mandatory education requirements for the medical marijuana program.

  • PFC offers regulators a third-party auditing option to ensure that licensed businesses are meeting standards required under regulationM
  • The PFC logo lets consumers, policy makers, regulators, community members, and health care providers know that companies are meeting standard requirements
  • PFC will monitor complaints and violations of regulations from patients and community members.
  • PFC trainings include: Legal, Raid and Robbery Preparedness, Patient Education, Good
  • Neighbor Polices, Safe Handling Protocols, Working with Patient Populations, Understanding Test Results and Delivery Systems, and Adherence to Local Laws and Regulations
  • Participants will receive educational materials for patients, caregivers, health care providers, resellers and regulators about the certification program.
  • Independent inspectors verify state and local rules, as well as, AHPA standards are followed by companies to ensure patient safety, quality and reliability.
  • Third party certification reduces regulatory oversight burden
  • PFC auditors can also be contracted as third-party auditors for regulatory agencies
  • Annual Audit Reporting

What is Third-Party Certification?

Third-party certification ensures that an independent organization has reviewed the manufacturing process of a product or management process of a service and has determined that the final product complies with specific standards for safety, quality or performance. PFC certifies compliance with AHPA standards. This review typically includes comprehensive formulation/materials reviews, testing and facility inspections. Certified products typically exhibit the certifier’s ‘mark’ on their packaging to help consumers make educated purchasing decisions. PFC requires annual inspections, unannounced random inspections and product testing to ensure that certified companies continue to meet all AHPA standards after the initial certification. Other nationally recognized certification programs include Good Housekeeping, NSF and ISO.

How Does PFC Help Regulators and Consumers?

Adopting PFC for compliance oversight by the industry can help ease the knowledge gap, financial and staffing burdens of regulators with third-party certification of compliance with regulations. PFC works with regulators and industry trade groups across the country to coordinate the ongoing and evolving development of medical cannabis industry standards. PFC provides regulators with access to some of the industry’s best technical experts, delivering consistent services with the highest levels of integrity and provides patients and their health care confidence the program’s participants meet the highest levels of safety and quality available.

What are AHPA Standards?

Standards are established guidelines, which provide a system of processes, procedures, and documentation to assure medical cannabis products, have the quality, strength, composition and identity they represent to possess and the companies that distribute them are committed to quality.

AHPA’s Cannabis Committee has developed standards in four areas:

  • Cultivation
  • Manufacturing, Packaging, Labeling and Holding
  • Distribution
  • Analytics

Companies participating in PFC are required to comply with any AHPA standards revisions within three months of issuance. PFC will notify all certified companies as standards are updated.

Cultivation Certification Program

  • Ensure the company is compliant with state and local regulations, licensing, and zoning requirements.
  • Demonstrate the safety of products used in your cultivation process. As the first link in the medical cannabis supply chain, your cultivation facility is the first line of defense in ensuring product safety for patients.
  • Certify medical cannabis product does not contain an unacceptable level of contaminants.
  • Verify adherence to currently recommended Good Cultivation Practice for the medical cannabis industry.
  • Determine the hazard, risk and impact of the products used in your medical cannabis cultivation processes to ensure environmental, employee and patient safety.

The certification process includes: document review, a label review to verify product and marketing claims, a contaminant review, testing to ensure there are no unsafe levels of contaminants and a facility inspection.

Manufacturing, Packaging, Labeling and Holding Certification Program

  • Ensure the company is compliant with state and local regulations, licensing, and zoning requirements.
  • Verify the identity and quantity of ingredients declared on the product label.
  • Demonstrate that the product does not contain undeclared ingredients.
  • Certify the product does not contain an unacceptable level of contaminants.
  • Verify adherence to currently recommended Good Manufacturing Practice for the medical cannabis industry.
  • Determine the hazard, risk and impact of the products used in your medical cannabis manufacturing processes to ensure employee and patient safety.

The certification process includes: document review, a label review to verify product formulation and marketing claims, a formulation review to identify and quantify dietary ingredients declared on the product label, a contaminant review, testing to ensure there are no unsafe levels of contaminants and a facility inspection.

Distribution Certification Program

  • Ensure the company is compliant with state and local regulations, licensing, and zoning requirements.
  • Demonstrate that the distribution company is committed to state and local compliant dispensing practices.
  • Verify adherence to currently recommended Good Distribution Practice for the medical cannabis industry.
  • Determine the hazard, risk and impact of the processes used in your medical cannabis distribution company to ensure employee and patient safety.
  • The Silver certification process includes: document review and a facility inspection.
  • The Gold certification process includes: a label review to verify product formulation and marketing claims and testing to ensure there are no unsafe levels of contaminants in products provided to patients.

Analytics Certification Program

  • Ensure the company is compliant with state and local regulations, licensing, and zoning requirements.
  • Demonstrate the lab’s commitment to accuracy and integrity.
  • Verify adherence to currently recommended Good Laboratory Practice for the medical cannabis industry.
  • Determine the hazard, risk and impact of the processes used in your medical cannabis laboratory to ensure employee and patient safety.

The certification process includes: document review, equipment and standards review, testing verification and a facility inspection.

Process for Certification

The certification process includes:

  1. Application – the PFC process begins when the licensee provides a completed application to ASA. We then complete a confidential review of the business operations to determine appropriate inspections and testing.
  2. Quote – using information the Application, ASA prepares a price quote and an estimate of time required for completing the certification process (generally $2,500 - $7,500 annually).
  3. Contract – a contract is executed outlining the responsibilities of all parties involved including financial obligations and acceptance of terms.
  4. Preliminary assessment (optional) – ASA provides procedures for the audit and questions management about facilities and processes.
  5. Documentation audit – an offsite review of company documentation determines if the company’s licensing and processes are sufficient to ensure adherence to standards.
  6. Employee training – experienced ASA trainers (currently licensed by the District of Columbia) provide employee training required by law, rules, and the AHPA standards as needed.
  7. Facility audit – trained ASA field inspectors conduct a confidential PFC standards audit and a facility inspection.
  8. Product testing – ASA tests for pesticides, molds, and contaminants with an independent third-party laboratory when available, necessary and appropriate for certification.
  9. Initial scoring and corrective recommendations – the licensee receives the results of the PFC audit and is given corrective actions to be taken as needed.
  10. Secondary audit as needed
  11. Certification – the PFC Executive Committee will issue the licensee’s certification once the inspector verifies any required corrective actions were taken and compliance all standards have been met.

Preliminary Assessment

In many cases, a company seeking certification may request an optional preliminary assessment of their operations. This gives ASA an opportunity to identify, in advance, any weaknesses that may exist in the company’s management systems. A preliminary assessment gives the company sufficient lead-time to correct deficiencies before the certification and assists ASA in planning for the certification. The scope of the preliminary assessment is determined by the company and may range from a review of documents to a full assessment. While the preliminary assessment is optional, it is recommended. Ultimately, it may save time and expense by revealing deficiencies that, if corrected before the certification review, can save you the expense of follow-up actions.

Documentation Audit

Once the PFC process begins, we will request copies of the licensee’s management system documents.

ASA will review the documentation to determine whether it meets all requirements of the state, local and AHPA standards.

Documentation should include at a minimum:

  1. Standards manual(s) – outlining systems utilized to conform to law, rule and AHPA standards;
  2. Operating procedures – describing how to perform system functions;
  3. Work instructions – defining specific job activities affecting the safety and quality of products and processes; and
  4. Quality documentation – documents that demonstrate how quality is managed including records including charts, files, inspection and testing records, assessment results, and any other records of objective evidence.

If the documentation fails to meet standards, the deficiencies will be identified in a report and the licensee is required to take corrective action before certification is awarded. Once ASA has determined that the documented management systems are satisfactory, a facility audit will be scheduled.

Introductory Meeting

The first day of the audit, the PFC team will meet with company management and other staff and contractors directly involved in the company’s management system. The meeting will include an overview of the audit process to give the licensee clear expectations for the process. During this meeting, ASA will review the audit scope and objectives, confirm the audit schedule and resources and review the procedures for identifying and reporting deficiencies. The licensee is required to provide a main point of contact to accompany the PFC team through the audit process.

Facility Audit

ASA will assign a qualified inspection and audit team to complete a full assessment of the facility and operations. The team will consist of one or more members depending on the size and purpose of the facility. PFC auditors have extensive experience (three years or more direct experience) in the medical cannabis and herbal products industries.

An audit agenda will be prepared for the licensee prior to the arrival of the PFC team including a daily schedule and any accommodation requests. It is the audit team’s responsibility to verify whether the management systems are meeting all of the requirements of applicable standards.

Following the introductory meeting, the audit team will perform a facility walk-through to observe activities. Team members may obtain samples for testing, conduct private interviews with employees, inspect documents and records, observe work processes and examine equipment. The objective of the facility audit is to evidence technical competency including statements, documented procedures, and records and written policies, which support observations.

If any deficiencies are found during the course of the audit, the team will bring them to the licensee’s attention and record them on a corrective action report. A deficiency report will specifically describe in detail what deficiency was observed and the related standard or policy to which it relates.

Product Testing

PFC provides a wide range of comprehensive medical cannabis product safety testing where available (services may be limited in some states). PFC’s testing services help our certified companies establish product stewardship by confirming content and purity, identifying problems with contamination, and determining potential for human and environmental exposures to ingredients and by-products including potency, residuals and microbiological. The program specializes in examining products and packaging to ensure public and patient safety. Testing services are provided by our certified labs conforming to AHPA’s laboratory standards and any applicable law and regulation. Testing for certification is limited to necessary testing to meet standards but our certified labs can provide licensees additional services as requested.

Exit Meeting

Upon completion of the on-site audit, the PFC team will conduct an exit meeting. A summa- ry review of the facility audit will be given to management and regulators as applicable. If any deficiencies were recorded, they will be described at this time and included in a facility audit report. The licensee is given a reasonable time period to take corrective action.

Corrective Action

Any and all deficiencies are given a reasonable time to correct; however, they must be corrected before certification can be granted. The corrective action response must include objective evidence, which shows the necessary corrective actions have been completed. PFC may require a follow-up facility audit, limited to the area of concern, depending on the nature of the deficiency. Certification cannot be awarded until any and all deficiencies have been adequately corrected.

Final Review, Report and Appeal Process

Within 10 business days of the facility audit (if no deficiencies are found) or upon confirmation of completed corrective actions, PFC will issue a confidential report and certification decision (report will be provided to regulators if necessary). All documentation will be for- warded to PFC’s Executive Committee, an independent decision-making body. The Executive Committee will review application materials and audit documentation and issue a decision on the certification. If the Executive Committee grants a company certification, they are notified immediately and the certification materials will be issued.

In the event that an application for PFC certification is denied, an appeal may be submitted within 10 business days of the issuance of the decision. ASA provides an independent Dispute Board including at least three members with sufficient knowledge and expertise to perform a review of materials and reports and issue an impartial decision.


Certification materials include:

  1. A certificate bearing PFC’s certification logo.
  2. A PFC certification window decal.
  3. Educational and promotional materials for patients, health care providers and regulators.
  4. PFC website links.
  5. Copies of certifications sent to regulators and localities as required by law Annual audit reports

At any time after certification has been granted the review period begins and the company may be subject to random and unannounced audits and/or product testing. An annual re- certification process is mandatory. Follow-up audits may require document submissions or an on-site visit. Certified companies are required to respond within 5 business days to any complaint submitted (by consumers, healthcare providers, stakeholder groups, regulators, etc.) to PFC for which a response is determined to be necessary. PFC will maintain records of complaints on certified companies that may trigger unannounced inspections. If for whatever reason certification must be suspended, PFC will notify regulators.

The length of time required to complete the certification process depends on several variables including: the type and size of facility, number of employees and complexity of operations. The amount of time it takes a company to achieve readiness for certification depends on the quality of management systems that are currently in place. PFC provides optional advisory services to identify and resolve documentation and process deficiencies in advance of the audit process.

The speed of the certification process depends on timely and complete responses from the applicant. A typical certification process will follow a timeline similar to the following:

  1. Application Submitted
  2. Quote Issuance
  3. Contract Execution
  4. Preliminary Assessment Completion (optional)
  5. Documentation Audit – (3-5 business days)
  6. Facility Audit/Product Testing – (3-5 business days)
  7. Corrective Action Period (if necessary) – (5-15 business days)
  8. Final Review, Report and Decision – (5-10 business days)

PFC Seals


Ongoing Review and Complaint Resolution

PFC will monitor certified operations throughout the certification period. In the event of law or rule change or when AHPA releases updated standards, a review audit may need to be completed. PFC will notify certified companies of any standard updates and provide an explanation of actions required by your company to comply and the required timeframe. Additionally, if any third-party complaints require an investigation or a large number of complaints are received, a review audit may be necessary. PFC will evaluate and respond to all third-party complaints verifying the legitimacy and severity of the complaint. Certified companies are required to respond to complaint inquiries by PFC within 5 business days.

PFC shall investigate complaints related to certified companies, misuse of the PFC logo by certified companies or use of the PFC logo by non-certified companies. Failure to cooperate in a complaint investigation will result in the termination of a PFC certification.

When filing a complaint, a Complaint Investigation Request provided by PFC must be completed and signed by the complaining party. Complaints will be sent directly to the program director who will track all complaints and investigations. PFC will acknowledge receipt of the complaint, promptly investigate and validate the complaint and take appropriate actions. PFC shall ensure the proper corrective actions are taken and notify the complainant of such actions. The certified company will be advised of the complaint at the appropriate time during the investigation. PFC shall determine, together with the certified company and complainant (and regulators where necessary), if the complaint and resolution should be made public.

When a complaint is made by a company, whether PFC certified or not, the complainant agrees to bear the cost of an investigation if the complaint is not verified. If the complaint is substantiated, the certified company shall be responsible for all costs of the investigation. Regulatory authorities, individual consumers and licensed health care providers are exempt from bearing the costs of any investigation costs. PFC shall not identify the complainant unless required to do so by law. If a complainant does not sign a Complaint Investigation Request, PFC will consider it an informal complaint and will investigate as needed, but has no obligation to investigate or respond.

About ASA and AHPA

PFC is committed to being the nationally recognized non-profit, third-party dedicated to patient health and safety solutions for all medical cannabis stakeholders including patients, health care providers, the medical cannabis industry and government agencies. Founded in 2002, Americans for Safe Access is the largest organization of patients, medical professionals, scientists and concerned citizens promoting safe and legal access to cannabis. We engage a multifaceted strategy of public education, impact litigation, grassroots development and advocacy, media campaigns, and direct support services.

The American Herbal Products Association chartered a Cannabis Committee in 2010 to attend to the needs of those of its members that grow, manufacture, or distribute medical cannabis in one of the states where its use is allowed by state law, and of companies that market industrial hemp products. AHPA has been the principal U.S. trade association and voice of the herbal products industry since 1982. AHPA promotes the economic health of the herbal products industry and promotes high quality herbal products. AHPA serves its members by promoting the responsible commerce of products that contain herbs and that are used to enhance health and quality of life. See more at:

For more information about this program, please contact:

Tim Murphy
PFC Program Manager


Please download a PDF copy of the information provided in this section. An investigation request form is included in the document.