A supplier quality agreement gives you the right to audit your hemp ingredient supplier. This guide is about how to exercise that right effectively. Whether you're conducting an onsite audit, a remote document review, or evaluating a new supplier's self-assessment, the same core areas require examination. A well-executed audit answers a question that COAs and documentation packages can't fully answer: does this supplier actually operate the way they say they do?
Before the Audit: Setting the Scope
A GMP audit of a hemp ingredient supplier should cover the key elements of the supplier's quality management system, not just the production floor. Before scheduling an audit, define the scope:
- Manufacturing facility inspection (if onsite)
- Quality documentation review (SOPs, specifications, batch records)
- Laboratory practices review (if the supplier performs in-house testing)
- Regulatory status verification (DEA registration, ISO 17025 accreditation, GMP certification)
- Corrective action and complaint history review
For new suppliers, a comprehensive audit covering all five areas is appropriate. For continuing suppliers with a clean track record, a focused audit on areas of previous concern or documentation updates may be sufficient.
Area 1: Facility and Premises
What to look for:
- Physical separation of hemp extract production areas from other activities that could cause contamination
- Adequate ventilation, temperature control, and humidity control in production and storage areas
- Pest control program with active monitoring records
- Cleaning and sanitation procedures with documented schedules and completion records
- Employee hygiene standards (handwashing stations, protective clothing, food/drink policies in production areas)
- Controlled access to production and storage areas
Questions to ask:
- What environmental monitoring is performed, and how frequently?
- How is the facility maintained between production runs for different products?
- What is the pest control contractor, and when was the last inspection?
Red flags:
- Evidence of pest activity (droppings, nesting, live insects)
- Production areas not cleaned between batches
- No temperature monitoring records in storage areas
- Employees handling product without appropriate protective equipment
Area 2: Raw Material Controls
What to look for:
- Incoming inspection procedure for hemp biomass and other raw materials
- COA review and approval process for each incoming lot before use in production
- Quarantine area for incoming materials awaiting release
- Physical segregation of approved, quarantined, and rejected materials
- Written specification for each raw material, including hemp biomass sourcing requirements (USDA-licensed producers)
- Supplier qualification records for biomass suppliers
Questions to ask:
- Who approves incoming material for release to production?
- What is the procedure if an incoming COA doesn't meet specification?
- Can you show me the incoming inspection records and COAs for the last three hemp biomass lots?
Red flags:
- No written specifications for hemp biomass
- COA review is informal or undocumented
- No physical quarantine area — all incoming materials stored together regardless of release status
- Supplier qualification records for biomass suppliers do not exist or are incomplete
Area 3: Production Controls
What to look for:
- Master Manufacturing Records or equivalent SOPs for each product
- Batch Production Records completed contemporaneously during production
- In-process testing procedures and records
- Equipment calibration and maintenance program with current calibration records
- Equipment cleaning and sanitization procedures with completion records
- Change control process for modifications to materials, equipment, or processes
Questions to ask:
- Can I review a batch record for a lot that was recently shipped to us?
- What is the process when a production parameter deviates from the specification?
- How is equipment qualified for use in hemp extract production?
Red flags:
- Batch records completed retrospectively rather than contemporaneously (dates and times don't align with production schedule)
- No in-process testing records
- Equipment calibration records show overdue calibration with no documented justification
- No change control records despite evidence of equipment or process modifications
Area 4: Laboratory Practices
If the supplier performs in-house testing in addition to or instead of third-party laboratory testing, review the laboratory practices:
What to look for:
- Laboratory equipment calibration records (especially HPLC, balance, pH meter)
- Reference standard documentation (cannabinoid reference standards with certificates of authenticity and expiry dates)
- Method validation documentation for cannabinoid potency and other methods performed in-house
- Analyst training and competency records
- Out-of-specification investigation procedures
Questions to ask:
- Which methods have been validated and to what specifications?
- How do you handle an OOS (out-of-specification) result?
- Are in-house results confirmed by the third-party DEA-registered laboratory, or are third-party results the only basis for lot release?
Red flags:
- No reference standard certificates or expired reference standards in use
- HPLC not calibrated or calibration overdue
- OOS investigations closed without adequate root cause investigation
- In-house results systematically higher or lower than third-party laboratory results without explanation
Area 5: Document Control and Record Retention
What to look for:
- Document control procedure ensuring that current versions of SOPs and specifications are in use
- Record retention policy meeting or exceeding regulatory requirements (three years minimum for hemp ingredient batch records)
- Complaint and adverse event handling procedure
- Corrective and Preventive Action (CAPA) system with open and closed CAPA records
Questions to ask:
- How do you control document versions? How would an employee know they're using the current SOP?
- Can you show me the three most recent CAPAs and their resolution status?
- What customer complaints or regulatory inquiries have you received in the past 12 months, and how were they resolved?
Red flags:
- Multiple versions of the same SOP in circulation on the production floor
- CAPA records show the same type of problem recurring without lasting corrective action
- No complaint records despite active distribution — either there are genuinely no complaints (rare) or complaints are not being captured
Scoring and Reporting
Following the audit, document your findings against each area and assign a rating: acceptable, needs improvement, or critical finding requiring corrective action before continued supply. A written audit report should be provided to the supplier, with a response required from the supplier within a defined timeframe (typically 30 days) for any needs improvement or critical findings.
Maintain audit reports in your supplier file. A supplier whose audit findings consistently improve over time is demonstrating a functioning quality system. A supplier who closes CAPAs on paper but shows the same findings at the next audit is not.
Conclusion
A GMP audit is one of the most powerful due diligence tools available to a B2B hemp ingredient buyer. It turns supplier documentation into verified operating practice — or reveals the gap between the two. In the current regulatory environment, the suppliers worth doing business with will welcome audits. The ones who resist them are telling you something important.
Low Gravity Hemp welcomes customer quality audits and maintains full documentation for all GMP areas described in this guide. Contact us to schedule an audit or request a documentation review.
