ISO, the International Organization for Standardization, has been bringing standards to manufacturers and other businesses since 1947.
ISO describes ISO 9001 as "a standard that sets out the requirements for a quality management system. It helps businesses and organizations be more efficient and improve customer satisfaction."
Kim Stuck of Allay Consulting says it is very relevant to the cannabis and hemp industries. "ISO 9001 is essentially just documentation -- it's systems, it's tracking where your product is going and what your product is doing, and training documentation," says Stuck. "Any manufacturing of any kind can use ISO 9001. It really is just a system of organization that any company should have to some degree."
She adds, "It can be used almost anywhere you're making something for the public. Even with manufacturing of extraction equipment, if you get a bad batch of bolts and you have to do a recall, it would help you."
Stuck says ISO 9001 is often paired with another foundational certification in cannabis. "A lot of it coincides with GMP," she says. "If you get your GMP certification, most of your ISO 9001 certification is already done."
Allay typically required about 25 billable hours more for a dual GMP/ISO 9001 project, but it's dependent on what organization is doing the certification, she adds. Allay works with BSI, NSF, SGS, and DNV GL, noting that the latter two will certify CBD companies, but not THC. "It's very different with each certifying body," she explains. "With SGS, if you do GMP with them, they roll in 9001. NSF doesn't do that; you actually have to do it separately."
Of the other ISO certifications, she notes, "The ISO 22000, that's the one I really like [for cannabis and hemp companies]. It's the manufacturing one, so if you're making any kind of food or oil or anything like that, the 22000 is the one you would want to go to.
While Allay is working with clients towards ISO 9001, the firm has yet to take on an ISO 22000 certification. "Anybody who has an ISO 22000 has ISO 9001 already," says Stuck. "The ISO 22000 is a little higher-level and it's a lot broader [than ISO 9001], so it would take a lot longer. That would have to be a separate project. . . . There is not any cannabis company right now that has ISO 22000 at this point, because we're just not far enough along to get there. There's only a handful of people who have GMP."
Certification for ISO 22000 involves "more paperwork" than 9001, says Stuck. "It's about monitoring, measurement, and analysis of evaluations. It's really nitpicky."
She adds, "A food safety management system is the bulk of it. Then it covers policy, so establishing your food safety policy, communicating the food safety policy, organizational roles and responsibilities, actions to [deal with] risks and opportunities."
She continues, "With the ISO 9001, it's putting the documentation all in place. 22000 requires extensive training, it requires more SOPs and documentation that are a little more interlinked and a little more detailed. . . . I feel ISO 22000 is the most impressive certification you can get. It is the most work as well, and you have to keep up on it."
ISO 22000 offers a methodology for a big gap in the cannabis industry, she adds. "Cannabis is highly unregulated when it comes to track and trace. People think it's really regulated because of Metrc, but most of the seed-to-sale systems are such poor tools."
The certification also makes for improved contingency planning, emergency preparedness, validation of control measures, and updating information. "It's like the icing on the cake of what GMP is," says Stuck. "It's more in-depth. Most food manufacturers that aren't in cannabis, these are the kind of things they have in place. GMP is really the first step to really, really tight compliance, especially if you want to sell internationally. Almost all international vendors from the United States have to have ISO 22000 or something comparable."
It's good for marketing, but it's really about crisis management. "Not only does it look good," notes Stuck, "it teaches your staff what to do if something goes wrong. It spells out a very specific role for each person. If this happens or something like this happens, you need to contact your manager. Your manager is then queued to contact someone higher up, and it goes from there."
She continues, "Every situation varies, but it will cut down on the issues people have when it comes down to, 'What do we do? We didn't call the health department for four days and 450 people got sick.' Or there was an issue and they didn't do anything, which unfortunately happens all of the time. It is one of the number-one reasons why there are outbreaks: People didn't know what to do, or they didn't have support from management. They felt like if they brought this to attention, they would get in trouble. Essentially, this system eliminates that issue. You know exactly what a problem looks like, exactly what risk level this problem is at, how quickly you have to act, and who you go straight to. There are some issues where you literally call the health department right away."
Stuck says other ISO certifications are applicable to cannabis and hemp manufacturing, but they're not available -- yet. "The issue is that the certifying body is only making those two available to us," she explains. "Food safety and quality assurance make sense. I think all ISO certifications will be available to the industry, but it's a ways out."
CBD manufacturers have more options than their THC counterparts, she adds. "Only a couple of our certifying bodies will do a THC certification. Most of them are working with hemp."
With operatives in Colorado, California, and Oregon, Allay has been offering ISO consulting since mid-2019. Contact Kim Stuck for more information.