Executive summary. No public European database isolates cannabis GMP findings comprehensively. This guide therefore synthesises recurring pharmaceutical inspection themes from EU, PIC/S, MHRA and FDA sources and applies them to cannabis-specific operations. It should not be presented as a statistical ranking. Its value is practical: these are the weaknesses most likely to undermine product quality, inspection confidence and batch release.
How to use this guide
The findings are grouped across quality systems, laboratories, manufacturing, validation and outsourced activities. Each item identifies why the deficiency matters and the direction of a credible response. Companies should assess relevance to their own product and process rather than copy a generic CAPA.
Findings 1–25
1. Pharmaceutical quality system not operating in practice
Procedures exist, but deviations, CAPA, management review and escalation do not function consistently. Inspectors compare written systems with actual records. Cannabis firms often expand faster than quality staffing. Corrective action: simplify processes, establish ownership, trend overdue records and demonstrate management decisions.
Full guidance →2. Inadequate investigation of OOS results
Passing retests are used to dismiss original failures without a proven assignable cause. Botanical heterogeneity is cited without evidence. Corrective action: separate laboratory and manufacturing phases, define hypotheses, preserve all data and assess sampling.
3. Weak data integrity and audit-trail review
Shared accounts, manual integration and incomplete review undermine potency and contaminant results. Corrective action: role-based access, controlled integration rules, audit-trail review and validated backup.
Full guidance →4. Unrepresentative flower sampling
Single grab samples are used for heterogeneous bulk lots. Corrective action: risk-based stratified plans, sampler training and documented representativeness.
5. Analytical methods not suitable for matrix
Vendor or compendial procedures are used without recovery, selectivity or matrix-effect evidence. Corrective action: product-specific verification or validation.
Full guidance →6. Reference standards poorly controlled
Acidic cannabinoids degrade or are used after expiry; purity values are copied without review. Corrective action: certificate review, aliquoting, solution-stability evidence and reconciliation.
Full guidance →7. Supplier qualification based only on questionnaires
Critical cultivators, laboratories or packaging suppliers are not audited or performance monitored. Corrective action: risk classification, verification testing, technical agreements and requalification.
Full guidance →8. GACP-to-GMP boundary unclear
Drying, trimming or storage responsibilities fall between systems. Corrective action: define technical handover, specifications, deviations and records.
Full guidance →9. Process validation not linked to botanical variability
PPQ uses similar batches and ignores cultivar, moisture or potency range. Corrective action: incorporate starting-material variability and continue verification.
Full guidance →10. Cleaning validation lacks cannabis-specific worst case
Highest potency is chosen without considering resin, wax, solubility or cleanability. Corrective action: documented worst-case scoring and recovery studies.
Full guidance →11. Residual-solvent control disconnected from process
Generic solvent panels are tested without mapping actual extraction, cleaning and recovered-solvent streams. Corrective action: solvent inventory and exposure-based limits.
Full guidance →12. Microbiological method suitability absent
Oil, terpenes or preservatives inhibit recovery. Corrective action: demonstrate neutralisation, dilution or filtration suitability.
Full guidance →13. Decontamination process inadequately validated
Irradiation or reduction treatment is used without demonstrating distribution, microbial reduction and product impact. Corrective action: validated dose/cycle and routine monitoring.
14. Stability programme too narrow
Only THC and CBD assay are monitored. Corrective action: include moisture, water activity, microbes, degradation, delivery performance and packaging interaction as relevant.
15. Packaging integrity not linked to shelf life
Closure torque or visual checks are treated as proof of protection. Corrective action: integrity/barrier studies tied to stability.
16. Change control misses regulatory impact
Cultivar, supplier, process or packaging changes are implemented before assessing variations or licences. Corrective action: mandatory regulatory assessment.
Full guidance →17. CAPA addresses symptoms, not systems
Retraining is repeatedly selected without root-cause evidence. Corrective action: system-focused actions with measurable effectiveness checks.
Full guidance →18. Equipment qualification relies entirely on vendor records
Site use, operating ranges and software are not verified. Corrective action: approved URS and user performance testing.
19. Computerised systems not validated
Spreadsheets, LIMS or chromatography systems lack controlled configuration and access. Corrective action: lifecycle validation based on risk.
Full guidance →20. Label reconciliation and line clearance weak
Printed components or online templates are not completely controlled. Corrective action: challenge vision systems, reconcile quantities and inspect digital job memory.
Full guidance →21. Complaints and recalls not connected to batch genealogy
Finished product cannot be traced efficiently to cultivation and processing records. Corrective action: end-to-end traceability exercises.
22. Contract laboratory oversight insufficient
The sponsor cannot access raw data, deviations or method changes. Corrective action: audit, technical agreement and ongoing review.
23. Environmental and utility monitoring lacks rationale
Limits or locations are copied from another facility. Corrective action: risk-based monitoring tied to use and system design.
Full guidance →24. Training records do not demonstrate competence
Personnel are marked trained after reading a procedure. Corrective action: practical qualification and periodic effectiveness checks.
25. Inspection readiness is cosmetic
Backlogs are closed immediately before inspection without sustainable remediation. Corrective action: routine self-inspection, evidence rooms and honest management review.
Inspection-readiness matrix
| System | Evidence an inspector will expect | Weak signal |
|---|---|---|
| PQS | Current trends, management decisions and effective CAPA | Procedures without performance data |
| Laboratory | Raw data, audit trails, validated methods and sample traceability | Passing certificates only |
| Validation | Lifecycle rationale and continued verification | Vendor protocols alone |
| Suppliers | Risk-based qualification and ongoing monitoring | Questionnaire-only approval |
| Batch release | Independent review of complete evidence | Commercial pressure overriding unresolved issues |
Frequently asked questions
Are these findings based on a cannabis-only inspection database?
No. They synthesise common pharmaceutical inspection themes and apply them to cannabis.
Which finding is most serious?
Severity depends on patient and product risk, but data integrity, contamination and unreliable release decisions can become critical.
Should a company fix all 25 before inspection?
It should assess all relevant systems and prioritise based on risk.
Is a recent GMP certificate evidence that no findings exist?
No. Certificates have scope and timing limits, and systems can deteriorate.
What is the best inspection preparation?
Routine compliance, self-inspection, honest management review and readily retrievable evidence.
Why are supplier controls so important?
Cannabis product quality is heavily influenced by cultivation, external laboratories and cross-border partners.
Sources and further reading
- European Commission — EudraLex Volume 4, EU GMP
- PIC/S publications and PE 009
- MHRA GxP Data Integrity Guidance
- FDA OOS Investigation Guidance
- 2025 study of 99 GMP inspection reports across 19 countries
- ICH Q9(R1), Quality Risk Management
- ICH Q10, Pharmaceutical Quality System
Market figures and regulatory positions can change quickly. Confirm current official data and national law before relying on this publication for investment, medical, legal or operational decisions.