Template:LIMSpec for Cannabis Testing/Introduction/LIMS functionality requirements specific to cannabis testing

LIMS functionality requirements specific to cannabis testing

The average general-purpose laboratory information management system (LIMS) will have a wide array of functionality. However, such a LIMS developed with quality in mind will take into account additional factors, such as the requirements that current regulatory schemes, industry standards, and organizational guidelines place on the development of a LIMS. This development can and should be framed with a strong specification based on those regulations, standards, and guidelines, a specification such as LIMSpec. Such a specification ideally addresses system requirements involving aspects including but not limited to sample management, reporting, resource management, quality control, system and instrument integration, data integrity, and cybersecurity.

But what about the special requirements of a cannabis testing laboratory? How does a specification document like LIMSpec—and by extension, a LIMS—address those laboratory needs?

About the following content

The following examines the special needs of cannabis testing laboratories—from quality assurance labs to R&D labs—and how a LIMS can address them. In particular, those stated special needs are matched to the exact requirements statements found in the subsequent chapters of this guide. Additional background is also provided. In a few rare cases, a LIMSpec requirement may not have a specific regulation, standard, or guidance document matched to it. These represent areas where regulatory bodies and standards agencies may need to address a gap in the future.

Sample registration

Cannabis testing LIMS requirement: The system should provide sample registration screens optimized for the cannabis testing industry, including the ability to differentiate among medical marijuana, recreational marijuana, and hemp, as well as derivative products and their various substrates. All necessary aspects of information capture should be in place, including listing the documentation included with the sample or lot.

Relevant LIMSpec:

• 1.11 The system should support the creation of user-definable default sample registration preferences and/or input screens—including associated measurement units and any other regulation-mandated attributes—based upon the various cannabis substrates/matrices and derivative products tested, as well as the sample source location and/or laboratory location.
• 1.12 The system should allow for the manual or automated recording of sample shipping details such as deliverer, location, shipper sample/batch/lot ID, laboratory sample/batch/lot ID, shipper ID, included documentation, and relevant dates and times for both preregistered and post-analysis samples and batches, for chain-of-custody tracking purposes.

Additional background: Even though some LIMS already provide the ability for users to define their own sample registration screens and fields, it doesn't necessarily mean the vendor will also include pre-loaded screens and preferences for a specific industry or scientific discipline. Those vendors tailoring sample registration screens and preferences specifically to cannabis testing lab requirements for launch-day deployment have a step up on other LIMS vendors. Also, sample registration should also support both remote sampling and in-lab sampling activities.

Pre-loaded cannabis testing protocols, labels, and analytical reports

Cannabis testing LIMS requirement: The system should offer pre-loaded compliant cannabis testing protocols, labels, and analytical reports that are optimized to and readily adjustable for a rapidly changing industry.

Relevant LIMSpec:

• 1.2 The system should allow for the creation and use of pre-configured (e.g., for standard inflorescence) and customizable (e.g., for differing substrate/matrix) sample labels, with barcode support.
• 1.6 The system shall allow for the addition, modification, and removal of new, pre-defined, and custom cannabis-related analytical tests and test protocols—with configurable measurement units and substrates/matrices—while preferably coming pre-loaded with common state- and local-compliant cannabis testing protocols. These protocols should include testing for acid and neutral forms of cannabinoids, potency testing, strain identification, water activity, moisture content, pesticides, solvents, heavy metals, microbiological contaminates, fungi, mycotoxins, and foreign matter.
• 4.1 The system shall allow for the verification of specification limits for accuracy or tolerances while indicating to the user when values are exceeded.
• 6.5 The system shall substantiate the status of verified results by using tools like a customizable certificate of analysis. The configuration options for certificates of analysis shall allow for setting unique identifiers; analysis procedures used; measurement units; reference intervals; environmental conditions; who provided the results; pass/fail status; additional comments, opinions, and interpretations and who provided them; applicable times and dates; and any other required fields as dictated by state and local regulations.
• 6.6 The system shall allow a certificate of analysis to be generated upon the verification and approval of results and associated metadata by authorized personnel.
• 6.7 The system shall provide the ability to clearly and accurately generate reports for a variety of standard situations, including certificates of analysis from testing, pending samples for approval, out-of-specification samples and tests, instruments pending calibration, expired reagents to be disposed, and trend charts of laboratory performance.
• 6.8 The system should, in addition to standard reports, provide the means for custom automatic and manual reporting, including but not limited to sample registration reports, work and backlog lists, laboratory performance reports, instrument reports, statistical analysis reports, regulatory reports, incident reports, chain of custody reports, quality assurance reports, service reports, inventory analysis reports, and investigator/sponsor reports.

Additional background: As with sample registration, end users of a cannabis testing LIMS will appreciate having a wide array of pre-loaded testing protocols, label templates, and report templates that support the testing of acid and neutral forms of cannabinoids, potency, strain, water activity, moisture content, pesticides, solvents, heavy metals, microbiological contaminates, fungi, mycotoxins, and foreign matter. This includes the ability to configure measurement units, as well as customize analytical reports such as certificates of analysis (COAs) for multiple state- and locally regulated testing scenarios like batch testing and batch-by-batch variance analysis.

Creation and management of additional protocols, labels, and analytical reports

Cannabis testing LIMS requirement: The system should provide users the tools for creating new, compliant test protocols, labels, and reports, as well as managing them as the industry changes.

Relevant LIMSpec:

• 1.2 The system should allow for creation and use of pre-configured (e.g., for standard inflorescence) and customizable (e.g., for differing substrate/matrix) sample labels, with barcode support.
• 1.6 The system shall allow for the addition, modification, and removal of new, pre-defined, and custom cannabis-related analytical tests and test protocols—with configurable measurement units and substrates/matrices—while preferably coming pre-loaded with common state- and local-compliant cannabis testing protocols. These protocols should include testing for acid and neutral forms of cannabinoids, potency testing, strain identification, water activity, moisture content, pesticides, solvents, heavy metals, microbiological contaminates, fungi, mycotoxins, and foreign matter.
• 4.1 The system shall allow for the verification of specification limits for accuracy or tolerances while indicating to the user when values are exceeded.
• 6.8 The system should, in addition to standard reports, provide the means for custom automatic and manual reporting, including but not limited to sample registration reports, work and backlog lists, laboratory performance reports, instrument reports, statistical analysis reports, regulatory reports, incident reports, chain of custody reports, quality assurance reports, service reports, inventory analysis reports, and investigator/sponsor reports.
• 7.5 The system shall allow the creation, approval, rejection, and management of the various cannabis sampling and test methods performed at the laboratory, capturing details about the test method, method reference, specifications, assigned specification limits, holding times, etc., as required by a reference method or regulation.
• 23.9 The system shall support configurable cannabis-related laboratory workflows based on appropriate laboratory process and procedure, as well as any regulatory requirements at the federal, state, and local levels.

Additional background: As with pre-loaded protocols, labels, and analytical reports, providing users the ability to create and manage their own protocols, labels, and reports—including COAs—as the industry changes is vital. Similarly, the same need for a flexible yet robust means of adjusting limit sets—and preserving older ones—is also required.

Flexible specification limit sets for quality control

Cannabis testing LIMS requirement: The system should support the development and maintenance of flexible and robust limit sets for various state and local regulations, as well as specific substrate testing requirements, to facilitate better quality control monitoring and reporting.

Relevant LIMSpec:

• 4.1 The system shall allow for the verification of specification limits for accuracy or tolerances while indicating to the user when values are exceeded.
• 23.2 The system shall allow authorized users to configure the specification limits for instrument- and sample-based tests, per laboratory testing protocols and/or state and local regulations, including for specific substrate/matrix types.

Additional background: A vital component of the previously mentioned testing protocols that should not be overlooked is how flexible their test parameter/specification limit sets are. As regulations and standards concerning cannabis testing—across many different substrates—may change rapidly at the federal, state, and local level, adjustments to the limits declared within testing protocols must be easy to make. Additionally, the system should be capable of retaining older historic limit sets, such that past results can later be accurately linked to their original limit sets. When in place, these limit sets can help improve quality control and the reporting of OOS samples and results.

Third-party system integration

Cannabis testing LIMS requirement: The system should provide a means to manually or automatically connect with and securely transfer information between (integrate with) state-required compliance reporting systems, seed-to-sale systems, and other software systems like enterprise resource management (ERP) solutions.

Relevant LIMSpec:

• 18.1 The system should be capable of communicating any status changes for samples, lots, instruments, and other dynamic entities to and from external systems, including point-of-sale systems, cultivation management systems, seed-to-sale systems, and any other state- and locally mandated industry reporting systems.
• 18.6 The system should be able to interface directly with a third-party reporting tool, including seed-to-sale and other state- and locally mandated reporting tools.
• 18.7 The system should be capable of being configured to and conform to the laboratory's existing data storage platforms and standards.
• 18.15 The system shall provide a means to integrate and exchange data electronically based on relevant methods, and in such a way so as to ensure accurate and secure data transfer and processing among instruments and third-party systems like state- and locally mandated seed-to-sale systems.

Additional background: Seed-to-sale systems, like METRC, or other types of government-mandated reporting systems may have a web-based user interface (webUI) for manual entry of results data, or they may even support a .csv upload of data. However, manual entry of results can be time consuming and result in a higher likelihood of errors. As such, the more efficient way to report data to those types of systems is through more automated means, connecting your LIMS with a web-based application programming interface (API), typically provided by the vendor of the seed-to-sale or reporting software. This means the LIMS must either be pre-configured to connect with all the necessary APIs or be equipped to handle connection with any API.

Instrument integration

Cannabis testing LIMS requirement: The system should provide robust support for accurately and securely integrating with and collecting data from numerous types of scientific instruments.

Relevant LIMSpec:

• 17.1 The system should be able to use an application programming interface or web services to communicate with the instrument data systems common to cannabis testing, including chromatography, spectroscopy, spectrometry, and polymerase chain reaction systems.
• 17.2 The system should be capable of sending samples and test orders to the instrument data systems common to cannabis testing.
• 17.3 The system should be capable of receiving test results from the instrument data systems common to cannabis testing and verifying those results for completeness and readability.
• 17.4 The system should be capable of generically parsing instrument data from the instrument data systems common to cannabis testing, in order to extract important sample details and results.

Additional background: From mass spectrometers and chromatography equipment to quantitative polymerase chain reaction (qPCR) systems and moisture balances, being able to accurately and securely transfer analytical data automatically improves turnaround time and better ensures the accuracy of entered results (versus manual data entry). This is particularly important in the highly regulated industry that is cannabis testing.

Granular chain-of-custody at every step

Cannabis testing LIMS requirement: The system should provide accurate, automatic chain-of-custody (CoC) tracking, down to a granular location level (e.g., "Storage Room 3, Freezer 1, Shelf 3"), and at every step (including package receipt and sending).

Relevant LIMSpec:

• 1.9 The system shall be able to define the sample collection details for registered samples, including container size and type, number of containers, collection date and time, name of the collector, lot number, storage location, preservation method, collection methods used (standard and nonstandard), safety concerns, and retention period.
• 1.12 The system should allow for the manual or automated recording of sample shipping details such as deliverer, location, shipper sample/batch/lot ID, laboratory sample/batch/lot ID, shipper ID, included documentation, and relevant dates and times for both preregistered and post-analysis samples and batches, for chain-of-custody tracking purposes.
• 1.14 The system shall provide a user-friendly means for acknowledging the physical reception of sample material in the laboratory, including date and time of reception.
• 1.18 The system shall have the ability to maintain the chain of custody of every sample, meaning the recording of every single sample distribution step to personnel—including details such as unique identifier, name, location, date, and time—while the sample is in the laboratory’s possession.
• 1.19 In the case of regulated samples such as cannabis, the system shall also allow for the recording of transfers to other entities outside the laboratory, including details such as personnel involved, their certification numbers (if applicable), dates, times, and any other required shipping information.
• 15.5 The system should provide a means for accurately recording the receipt, issue, distribution, and disposal of materials.

Additional background: A nickname for a seed-to-sale system is a "track-and-trace" system, highlighting the importance of always knowing the who, what, where, when, and how much of cannabis materials and related products in the industry life cycle. This concept is often referred to as the "chain-of-custody" of cannabis related material. This chain-of-custody is not limited to received cannabis samples, either; it also includes any subsamples and aliquots generated in the testing laboratory, as well as any disposed materials. As such, it's vital the LIMS be able to accurately document the chain of steps received cannabis materials go through, from reception and retention to delivery and destruction. Without this careful documentation, a cannabis testing lab is open to costly fines or, worst case, having their license suspended.

Inventory reconciliation

Cannabis testing LIMS requirement: The system should support inventory reconciliation, including sample weight reconciliation, while limiting data entry errors.

Relevant LIMSpec:

• 1.13 The system shall assign each sample registered in the system a unique identifier using methodologies such as an ID with an incrementing integer or a user-defined naming format.
• 1.15 The system shall allow for the comparison of received samples to the sampling requirements of the customer or laboratory in order to identify variances from those requirements.
• 2.9 The system should provide a means to manually or automatically track sample inventory amounts and status, including sample weight reconciliation, while limiting data entry errors.
• 4.1 The system shall allow for the verification of specification limits for accuracy or tolerances while indicating to the user when values are exceeded.
• 15.1 The system should be capable of accurately tracking the specific quantities of received and consumed test samples (as well as related subsamples and aliquots), including the ability to conduct sample weight reconciliation.
• 15.5 The system should provide a means for accurately recording the receipt, issue, distribution, and disposal of materials.

Additional background: Related to the "how much" of chain-of-custody tracking, sample weight reconciliation is an important element of avoiding regulatory violations. The LIMS should be able to either automatically deduct sample and inventory quantities when consumed as part of a test (including subsamples and aliquots), or it should allow manual entry of such changes with background validation checks or warnings. For example, the system would need to clearly warn the user when attempting to pull more weight from a sample than exists, which would create a negative value. Speaking of which...

Real-time alerts and issue tracking

Cannabis testing LIMS requirement: The system should support real-time alerts of out-of-specification (OOS) results, incomplete tasks nearing due date, and other situations, so immediate action can be taken, if required. This shall assist with lab efforts towards actively tracking issues for standard-based and regulatory purposes, as well ensure timely results to stakeholders.

Relevant LIMSpec:

• 3.12 The system should effectively alert users upon entry of out-of-specification test results.
• 12.6 The system shall provide a means for configuring notifications and alerts for incomplete tasks nearing their due date. (Currently no regulatory- or standard-based requirement for this.)
• 16.3 The system shall be able to record instances of identified nonconformance and method deviation, as well as the actions required to restore the process to conformity. In the case of a planned deviation, the system shall require documentation, justification, proof of validation, adjusted reference intervals, and authorization for the deviated process.
• 16.4 The system should clearly identify samples and tests that are out-of-specification (OOS) and out-of-trend (OOT) as unique incidents.
• 16.5 The system should trigger an alert or notification when an OOS/OOT status is found, prompting a documented investigation to identify the root cause.
• 16.6 The system shall allow for the documentation of and corrective and preventive action towards all types of nonconformance.
• 16.7 The system should track and record incidents and associated corrective actions, allowing authorized personnel to document the effectiveness of the actions, identify insufficient resolutions, and curb repeat occurrences.
• 16.8 The system should provide a means for configurable workflows to manage OOS and OOT incidents according to an organization’s standard operating procedures.

Additional background: As part of maintaining quality assurance and compliance with regulations and standards, it's important users be warned when something goes awry with data entry and analysis. This is typically controlled through the previously mentioned limit sets associated with pre-loaded and custom test protocols. However, other error checking of automatic and manual calculations, e.g., weight reconciliation, should also be inherently built into the LIMS. However, the checks are not enough; users must clearly and promptly be notified of errors and OOS results (via the limit sets) in order to, for example, identify health risks associated with a tested product and send notification that the product should be pulled from store shelves. Additionally, the requirement for maintaining quality testing outcomes for consumer safety and client satisfaction further drives the need for prompt real-time alerts, as does the need for ensuring scheduled tasks are completed before they are due.

Capacity and performance monitoring

Cannabis testing LIMS requirement: The system should provide mechanisms for creating, configuring, and monitoring workload, instrument allocation, and scheduled tasks, as well as other custom key performance measures (KPMs) designated as important by the lab.

Relevant LIMSpec:

• 6.10 The system should provide a means to use data and metadata in the system to create formulas for developing key performance measures (KPMs), which can be monitored, visualized, and reported on by authorized personnel on a periodic basis. (Currently no regulatory- or standard-based requirement for this.)
• 10.4 The system should record instrument usage time to assist laboratory personnel with capacity planning and scheduling.
• 12.1 The system shall allow users to create, maintain, and revise schedules—and any associated due dates—for various laboratory tasks and processes, while making scheduled tasks easy to monitor from one system location, e.g., using a dashboard.
• 19.1 The system should be able to accurately gauge and report test-based work capacity or throughput.
• 19.2 The system should provide scheduling tools for allocating personnel and instruments to laboratory tasks.
• 19.3 The system should provide a means for tasks to be scheduled and allocated against available resources.
• 19.4 The system should be able to track and limit the quantity of samples or hours worked on a type of sample by personnel, e.g., number of mycotoxin analyses or hours worked on them.
• 23.8 The system should be capable of providing a complete list of all pending tests loaded in the system, the amount of material required for each test, and to which location the associated samples are to be sent for testing.

Additional background: Whether an R&D cannabis lab or a quality assurance lab for cannabis, monitoring workloads, instrument allocations, scheduled tasks, OOS results, and any lab-specific performance indicators is vital for ensuring quick turnaround time (TAT), accurate results, productive workflows, and positive regulatory outcomes. Similar to issue tracking, capacity and performance tracking also help maintain quality testing outcomes and client satisfaction. Many LIMS already have basic forms of these monitoring features, but not all do, let alone more advanced monitoring functions like custom KPM creation and management.

Data security and confidentiality

Cannabis testing LIMS requirement: The system should ensure data security and confidentiality for at-rest and in-transit data.

Relevant LIMSpec:

• 26.1 The system should use secure communication protocols like SSL/TLS over Secure Hypertext Transfer Protocol with 256-bit encryption.
• 26.2 The system should support database encryption and be capable of recording the encryption status of the data contained within.

Additional background: When it comes to cannabis and protected health information (PHI), dispensaries are the most likely to require careful attention to consumer information. However, that does not preclude laboratories from making strong efforts to protect sensitive personal data related to clients and their analyses (let alone to protect the lab's own validated methods and documentation). As such, cannabis testing labs should rely on a LIMS that uses industry-standard communication protocols and encryption methods to protect not only the data housed in the LIMS but also data moving in and out of it.

Accounting and billing

Cannabis testing LIMS requirement: The system should provide accounting and billing functionality, including quoting and invoicing, for not only optimal business operations but also to ensure compliance with any regulations involving monetary transactions for cannabis-related services.

Relevant LIMSpec:

• 8.9 The system should provide accounting and billing functionality, including quoting and invoicing, for not only optimal business operations but also to ensure compliance with any regulations involving monetary transactions for cannabis-related services. (Currently no regulatory- or standard-based requirement for this.)

Additional background: Though not necessarily backed by any regulation or standard, carefully tracking expenditures and payments received related to cannabis activities is vital. This is especially true given that the non-hemp (low-THC) Cannabis plant is still technically illegal to grow and process in the eyes of U.S. federal law. As such, some businesses taking in money from cannabis-related activities have had problems with managing the financial aspects of their operations. Given the remaining uncertainty of cannabis legalization in the U.S., and the natural benefits of managing accounting and billing within the LIMS, it makes sense that a LIMS should be able to accurately track receipts and more, down to the penny.

Secure web portal

Cannabis testing LIMS requirement: The system should provide a secure web portal for client results review and test ordering.

Relevant LIMSpec:

• 6.11 The system should provide a secure web portal for clients to not only order tests but also review the results of their ordered tests, including full access to the associated certificates of analysis. (Currently no regulatory- or standard-based requirement for this.)

Additional background: Similar to accounting and billing functionality, this requirement for a portal for customer access isn't necessarily mandated by any regulation or standard. However, it remains a useful time-saving and customer service element. Additionally, the "secure" part of this requirement must be emphasized. This ties directly to the prior requirement for data security and confidentiality. Web-based attacks remain some of the most popular cybersecurity attacks, targeting the likes of online customer portals and WordPress sites for credentials and sensitive information. A quality LIMS that has already proven strong data security gives confidence in the LIMS vendor's ability to implement a web-based customer portal for order review and test ordering.

ISO/IEC 17025 compliance support

Cannabis testing LIMS requirement: The system should support a laboratory's ISO/IEC 17025 compliance efforts.

Relevant LIMSpec:

• 1.13 The system shall assign each sample registered in the system a unique identifier using methodologies such as an ID with an incrementing integer or a user-defined naming format.
• 2.8 The system should allow for the accurate identification of a physical sample in the system via barcode or RFID technology.
• 4.4 The system shall provide one or more levels of review, as well as interpretation and documentation of results—whether entered manually or via an automated process—before release.
• 6.5 The system shall substantiate the status of verified results by using tools like a customizable certificate of analysis. The configuration options for certificates of analysis shall allow for setting unique identifiers; analysis procedures used; measurement units; reference intervals; environmental conditions; who provided the results; pass/fail status; additional comments, opinions, and interpretations and who provided them; applicable times and dates; and any other required fields as dictated by state and local regulations.
• 6.9 The system shall clearly identify a changed, amended, or re-issued report as being such, and clearly identify any change of information and reason for change in such a report.
• 7.1 The system shall be capable of creating, managing, and securely holding a variety of document types, while also allowing for the review and approval of those documents using version and release controls.
• 7.2 The system shall have the ability to readily provide access to electronic documents such as standard operating procedures, quality manuals, instrument manuals, information exchange agreements, and other applicable documents to designated personnel and officials.
• 7.3 The system shall be able to clearly provide the most current version of a document and archive prior versions.
• 7.5 The system shall allow the creation, approval, rejection, and management of the various cannabis sampling and test methods performed at the laboratory, capturing details about the test method, method reference, specifications, assigned specification limits, holding times, etc. as required by a reference method or regulation.
• 7.6 The system shall provide a means for recording validation information for modified existing or new in-house cannabis test methods, either as a method itself or through some other means. Validation information such as procedures used, specifications, performance characteristics, and results obtained shall be allowed as input.
• 7.7 The system shall maintain training and certification records for personnel and allow the assignment of available training paths and certifications to specific personnel, such that only trained, certified, and experienced personnel—per state and local regulations—are able to perform assigned tasks.
• 8.8 The system shall map available system tasks (such as approved test methods) or sample types (such as select agents, toxins, or substrates/matrices) to available training paths and certifications, such that only trained, certified, and experienced personnel are able to perform assigned tasks.
• 10.7 The system shall allow for the configuration of calibration and maintenance frequency and time frames for—as well as the manual and automatic scheduling of calibration or maintenance of—equipment, instruments, and systems. Available intervals should include days, weeks, months, and years.
• 10.9 The system shall clearly identify any instrument that is out-of-calibration, beyond its preventative maintenance due date, or under investigation, while preventing it from being selected for use.
• 10.10 The system shall be able to show all instances of scheduled calibration, preventative maintenance, and service dates for an instrument.
• 10.11 The system shall be able to link a calibration activity to certified reference material or designated measurement processes.
• 10.13 The system shall be able to uniquely identify each instrument and any associated components and maintain that and other information—such as manufacturer, model number, serial number, and calibration and maintenance history—within the system.
• 10.15 The system shall be capable of chronologically logging details for scheduled and unscheduled calibration and maintenance activities for each instrument, including calibration status, calibration standard, date and time of calibration or maintenance, work performed, who conducted it, and signatures of those verifying the completed activities.
• 16.3 The system shall be able to record instances of identified nonconformance and method deviation, as well as the actions required to restore the process to conformity. In the case of a planned deviation, the system shall require documentation, justification, proof of validation, adjusted reference intervals, and authorization for the deviated process.
• 18.3 The system shall provide a means to choose—based on date and type of data—electronic data and metadata to archive.
• 18.4 The system shall provide a guaranteed means to retrieve and restore archived data and metadata that is readable and accurate.
• 18.11 The system’s data storage tools shall provide data backup and retrieval functions that meet or exceed industry best practices, including producing exact and complete backups that are secure from manipulation and loss.
• 21.9 The system should allow for other types of facility monitoring (such as alarm, light, lock, and door statuses) and send notifications when necessary with recommendations for immediate and corrective action. The system should also maintain a log of all such monitored systems and their status changes.
• 21.11 The system should allow for environmental control and monitoring of equipment (such as incubators and freezers) and send notifications when necessary with recommendations for immediate and corrective action. The system should also maintain a log of all such monitored equipment and their associated status changes.
• 22.4 The system shall have a mechanism to securely retain data in the system for a specific time period and enable protections that ensure the accurate and ready retrieval of that data throughout the records retention period.
• 23.22 The system shall provide a security interface usable across all modules of the system that secures data and operations and prevents unauthorized access to data and functions.
• 24.4 The system should be well documented by the vendor in comprehensive training material for all aspects of system use, including administration, operation, and troubleshooting.
• 24.5 The system shall be validated initially and periodically, with those validation activities being documented, to ensure the accuracy, consistency, and reliability of system performance and its electronic records.
• 25.7 The vendor shall restrict logical access to database storage components to authorized individuals. If providing a hosted service, the vendor should also restrict physical access to database storage components to authorized individuals. (In the case of an on-site solution, the buyer is responsible for limiting physical access to database storage components to meet 21 CFR Part 11, HIPAA, and CJIS guidelines.)

Additional background: In the U.S., many states mandate analytical testing of cannabis and its related products. This testing is prescribed as a public health safety measure, to ensure those consuming cannabis and derived products are not adversely affected by any harmful substances picked up during processing stages. By extension the public must place trust in those labs conducting this testing, requiring a high level of quality within the laboratory and how it operates. This quality is better assured through laboratory accreditation checks to standards like ISO/IEC 17025, which provides competence requirements for testing and calibration laboratories. ISO/IEC 17025 requirements are non-trivial, covering many aspects of how the laboratory operates, and chief among those requirements is the need for a quality management system. And maintaining quality requires maintaining traceable documentary evidence of those efforts. This includes certificates of analysis, quality manuals, standard operating procedures, calibration and maintenance logs, and much more. Your LIMS should make strong efforts towards helping you maintain that documentary evidence to not only assist with compliance efforts, but also push your lab to maintain high levels of quality for those depending on accurate analyses.

NELAC, ORELAP, and ELAP compliance support

Cannabis testing LIMS requirement: The system should support a laboratory's NELAC or ORELAP compliance efforts.

Cannabis testing LIMS requirement: The system should support a laboratory's ELAP compliance efforts.

Relevant LIMSpec:

• 9.9 The system should support a laboratory's NELAC or ELAP compliance efforts. (NOTE: NELAC's Volume 1: Management and Technical Requirements for Laboratories Performing Environmental Analysis (2016) is proprietary and could not be obtained. The following LIMSpec items are based off New York's ELAP requirements.)
• 2.11 The system shall allow samples and tests to be created and used specifically for capturing data related to unique forms of sampling and testing such as representative sampling, calibration testing, quality control testing, preventative maintenance testing, stability testing, sterility testing, compatibility testing, identity testing, proficiency testing, and service-event-related testing.
• 7.1 The system shall be capable of creating, managing, and securely holding a variety of document types, while also allowing for the review and approval of those documents using version and release controls.
• 7.2 The system shall have the ability to readily provide access to electronic documents such as standard operating procedures, quality manuals, instrument manuals, information exchange agreements, and other applicable documents to designated personnel and officials.
• 7.5 The system shall allow the creation, approval, rejection, and management of the various cannabis sampling and test methods performed at the laboratory, capturing details about the test method, method reference, specifications, assigned specification limits, holding times, etc. as required by a reference method or regulation.
• 7.6 The system shall provide a means for recording validation information for modified existing or new in-house cannabis test methods, either as a method itself or through some other means. Validation information such as procedures used, specifications, performance characteristics, and results obtained shall be allowed as input.
• 7.7 The system shall maintain training and certification records for personnel and allow the assignment of available training paths and certifications to specific personnel, such that only trained, certified, and experienced personnel—per state and local regulations—are able to perform assigned tasks.
• 16.6 The system shall allow for the documentation of and corrective and preventive action towards all types of nonconformance.
• 16.7 The system should track and record incidents and associated corrective actions, allowing authorized personnel to document the effectiveness of the actions, identify insufficient resolutions, and curb repeat occurrences.

Additional background: Though ISO/IEC 17025 remains the major standard to be accredited to, other accreditation requirements exist in the world of cannabis testing. These requirements may be state-based, as with the Oregon Environmental Laboratory Accreditation Program (ORELAP) or New York's Environmental Laboratory Approval Program, Certification Manual Item 180.7 for Medical Marijuana. Others like the non-profit NELAC Institute provide national accreditation through its National Environmental Laboratory Accreditation Program (NELAP), which ORELAP is largely guided by. This includes NELAC's:

• EL-V1M1-2016-Rev2.1 Module 1, "Proficiency Testing"
• EL-V1M2-ISO-2016-Rev2.1 Module 2 "Quality Systems General Requirements"
• EL-V1M4-2017-Rev2.2 Module 4, "Quality Systems for Chemical Testing"
• EL-V1M5-2016-Rev2.0 Module 5, "Quality Systems for Microbiological Testing"

As such, this means covering ground similar to ISO/IEC 17025 regarding quality in the laboratory. To better meet these requirements, a cannabis testing LIMS should assist with the maintenance of documentation such as quality manuals, tracking laboratorians' credentials and experience, documenting corrective and preventative action, and documenting proficiency testing results, among other tasks.

Patient Focused Certification (PFC) compliance support

Cannabis testing LIMS requirement: The system should support a laboratory's Americans for Safe Access (ASA) Patient Focused Certification (PFC) Program laboratory compliance efforts.

Relevant LIMSpec:

• 9.10 The system should support a laboratory's Americans for Safe Access (ASA) Patient Focused Certification (PFC) Program laboratory compliance efforts. (NOTE: ASA's PFC document is proprietary and could not be obtained.)

Additional background: The American Association for Laboratory Accreditation (A2LA) incorporates the ASA's PFC Program into its cannabis testing laboratory accreditation, described in its R243 - Specific Requirements - Cannabis Testing Laboratory Accreditation Program document. However, the A2LA will "only give that document to prospective accreditation customers," according to personal communication. As such, it's not clear what those specific PFC requirements are and how they may relate to a LIMS' ability to maintain A2LA's PFC compliance. Presumably those requirements can be better met with a LIMS, whatever the requirements may be. If a vendor indicates their LIMS helps support PFC requirements, it's best to engage in a conversion with the vendor to determine how.