Manufacturing you can defend.
Every SOP, every batch.

When we finish this engagement, you’ll have a specific set of documents, records, and operational systems in your possession. These are not work-product narratives or ‘summary memos.’ They are archivable artifacts — cited, version-controlled, and defensible against future DCC inspection, diligence review, or recall scenario.

The ten outputs, in detail

• Product Quality Plans (PQPs) — one per product. The DCC's foundational document under CCR 17303 and the DCC PQP guidance: one PQP per product identifying every point, step, and stage in the manufacturing process and the risks of adulteration, misbranding, lab-test failure, or QA failure at each. Structurally the cannabis equivalent of a HACCP plan. For a typical multi-product operation this means 8–25 PQPs, each product-category-specific (edible, vape, concentrate, topical, tincture) with its own critical control points.
• Master Manufacturing Protocols (MMPs) — one per formulation. The recipe-plus-process specification under CCR 17303 and the DCC MMP checklist: written instructions per formulation specifying the type and amount of each ingredient, the equipment used, the process parameters (temperature, time, pressure), the QC checks at each stage, and the yield-reconciliation arithmetic that ties inputs to outputs plus waste. Organized by product category with cross-references to the PQP it executes and the SOPs it invokes. The first document framework DCC inspectors test on a manufacturing visit.
• Batch Production Record (BPR) templates — one per batch. BPR format under CCR 17304 and the DCC BPR checklist: contemporaneous evidence that the manufacturer used the monitoring methods identified in the PQP and followed the instructions in the MMP. Captures input COA and METRC tag, operator signoff at each critical control point, in-process check values (temperature, pressure, pH, potency where relevant), deviation references, yield calculations, and the QC review and release disposition for the finished product. Every field mapped to the regulation it satisfies.
• Unit operation SOPs. 15–40 SOPs depending on product portfolio — receiving, extraction (hydrocarbon, CO₂, ethanol where applicable), winterization, distillation, isolation, infusion, mixing, homogenization, filling, packaging, labeling, release, and shipping. Each written to the actual floor, not to a template.
• CAPA procedure and log templates. Corrective and Preventive Action procedure meeting cGMP expectations under 21 CFR Part 111 and the DCC enforcement-matrix structure of CCR 15048. Root-cause frameworks (5-Why, fishbone), effectiveness verification, and a living log that survives DCC inspection and diligence review.
• Complaint handling SOP. Documented intake, triage, investigation, and response procedure for adverse event reports, retailer complaints, and consumer inquiries. Critical as the first evidence source for a potential recall under CCR 17408 and BPC 26131.
• Recall readiness SOP with mock recall drill report. Written recall procedure meeting CCR 17408 and BPC 26131 requirements, including METRC hold protocol, customer notification templates, destruction documentation, and DCC reporting. Annual mock recall drill executed with written report demonstrating recall capability.
• Equipment qualification documents (IQ/OQ/PQ). Installation Qualification (equipment installed to specification), Operational Qualification (operates within parameters across the full range), and Performance Qualification (consistently produces conforming product) for every piece of processing equipment. Required for cGMP adjacency and strongly expected at DCC inspection.
• Training materials and documented training records. Role-based training curricula under CCR 15039, competency assessments, qualification records for critical roles (extraction operators, QA release personnel), and retraining triggers tied to deviation and change-control events.
• Document control system setup. Version-controlled document architecture with approved/effective dates, revision history, and distribution tracking. Works with most cannabis-market ERPs (Flowhub, Dutchie, Distru) or stands alone as a controlled document vault.

Format and delivery

Every document is delivered in editable source (Word or Pages) and final PDF. File naming follows a consistent convention keyed to SOP/BPR/PQP/MMP prefixes so the document vault stays auditable. All records retained for 7 years under CCR 15037 and CCR 17306. The quality manual is the top-level map tying every deliverable to its CCR subsection, its CFR equivalent (where applicable), and its place in the document hierarchy. Training on the new QMS is included — role-play scenarios for manufacturing and QA staff, plus a half-day inspection-readiness drill before any real DCC visit.

Defensibility anchor

Every SOP cites a specific regulation, statute, or industry standard. CCR 17303 for MMP and PQP. CCR 17304 for batch records. CCR 17306 for retention. BPC 26131 for recall. 21 CFR 111 for federal GMP adjacency. NFPA 1 for Type 7 extraction fire-code compliance. OSHA PSM for process safety where solvent thresholds trigger the standard. When DCC, FDA (if federal law changes), an auditor, or a diligence team asks ‘why this procedure?’ the answer is in the header of the document.

What’s not included

PE-stamped facility engineering (electrical classification drawings, HVAC certification, closed-loop extraction engineering) is separate work done by your licensed engineer — we review it and cross-reference it into the QMS but we do not produce it. FDA 510(k) or NDA filings (for any pharmaceutical-track cannabis product) are outside scope. Financial statement attestation and GAAP audit are outside scope. Product labeling content and regulatory-claim substantiation beyond CCR 17408 release review are handled by our Product & Label Compliance service. The engagement letter names these boundaries on day one.

Most compliance engagements feel opaque because firms guard their process. The work below is the opposite — exactly what happens, in order, and when each deliverable lands.

The playbook

• Operations Assessment. Two-day on-site assessment of your manufacturing floor: equipment inventory, product portfolio, existing SOPs, executed batch records, lab results, training matrix, and the closed-loop extraction certification (Type 7). We produce a Current State Assessment identifying every gap against CCR Title 4 §§ 17200–17418, the DCC PQP/MMP/BPR checklists, and the federal 21 CFR Part 111 dietary-supplement GMP framework that diligence reviewers use as the de-facto standard. The assessment lists each gap, its citation, and the priority tier for remediation.
• Document Architecture. We design the documentation triangle as DCC defines it: Product Quality Plan (PQP) per product identifying risks and critical control points, Master Manufacturing Protocol (MMP) per unique formulation specifying ingredients, equipment, and process parameters, and Batch Production Record (BPR) per batch capturing actual values and observations. SOPs per unit operation, Work Instructions per task, and supporting forms hang off that spine. Every document is cross-referenced to its CCR subsection and integrated with your existing document control system.
• Core Document Build. We write the PQPs, MMPs, BPR templates, SOPs, and CAPA procedures from observation of the actual floor — not generic templates. Each PQP identifies the adulteration, misbranding, and lab-failure risks specific to that product (allergen cross-contact in chocolate edibles, residual solvents in distillate, dosing homogeneity in gummies). Each MMP names the equipment, ingredient quantities, process parameters, and QC checks at every stage. Typical build is 4–8 weeks for a full QMS depending on SKU count and license type.
• Equipment Qualification. For new or previously unqualified equipment, we execute Installation Qualification (IQ confirming equipment installed to specification), Operational Qualification (OQ confirming operation across the full parameter range), and Performance Qualification (PQ confirming consistent conforming product output). For Type 7 facilities the PE-certification and re-certification record is integrated into the qualification package so material modifications trigger the engineering review the regulation requires. The output is the documented evidence DCC expects to see and that diligence reviewers use as the floor for institutional capital.
• Training & Rollout. We train manufacturing and QA staff on the new QMS: SOP execution, BPR completion (contemporaneous, not back-filled), deviation reporting, CAPA procedures, allergen-control practice in shared kitchens, and inspection-readiness behavior. Training is role-based with competency assessments, and every session is documented under CCR 15039 with retraining triggers tied to deviation and change-control events. The phase ends with a half-day inspection-readiness drill before the next real DCC visit.
• Ongoing QMS Maintenance. Quarterly document review cycle, CCR rulemaking monitoring (the DCC's 2025–2026 pesticide rulemaking and the periodic revisions to the CCR 17200 series both touch manufacturing), SOP revision tracking, BPR audit support, and the annual mock-recall drill that proves recall capability before the regulator tests it. Available as project work or as part of the Standard or Premium compliance retainer.

Duration and rhythm

From kickoff to working QMS is typically 10–14 weeks of active work across a 90-day engagement for Type 7 volatile-extraction facilities, 6–10 weeks for Type 6 non-volatile and Type N infusion-only operations, and 12–20 weeks for multi-product kitchens or Type S shared-use tenants where each tenant brings its own PQP/MMP/BPR set. Status calls run weekly with the named QMS lead and your QA director; document drafts circulate on a two-week cadence so feedback compounds rather than stacking. Where DCC inspection is imminent we pivot the sequence to inspection-readiness documentation first and complete the deeper QMS build behind it.

Who you work with each phase

One named QMS lead owns the engagement from intake to handoff — the same person on every status call, every document review, every floor visit. Specialist contributors come in at the milestones their work demands: an extraction subject-matter expert for closed-loop SOP review and PE coordination on Type 7 facilities, an allergen-control specialist for shared-kitchen and edible-line work, a recall-readiness drill leader for the annual mock-recall execution. Where the matter touches counsel territory — a Notice to Comply already issued, a recall with product-liability exposure, an enforcement interview — we coordinate with your retained counsel on a single record rather than running parallel.

• What's the difference between MMP and PQP?. Per the DCC documentation triangle under CCR 17303, the Product Quality Plan (PQP) is the foundational document — one per product, identifying every point, step, and stage in the process and the risks of adulteration, misbranding, lab failure, or QA failure at each. The Master Manufacturing Protocol (MMP) is one per formulation and codifies the written instructions to mitigate those risks: ingredients and amounts, equipment, process parameters, QC checks, and yield reconciliation. The Batch Production Record (BPR) under CCR 17304 is the per-batch record proving the PQP monitoring methods were used and the MMP instructions were followed. All three are required.
• Do I need cGMP for cannabis manufacturing?. California's CCR 17200–17418 series is cGMP-aligned but not identical to FDA cGMP. The DCC requires sanitation under CCR 17302, the PQP/MMP/BPR documentation triangle under CCR 17303 and 17304, personnel training under CCR 15039, and quality controls consistent with the cGMP principles adapted from food-industry practice. Operators planning multi-state operations or interstate commerce when federal rules permit benefit from full 21 CFR Part 111 alignment, and most institutional diligence reviewers apply Part 111 as the de-facto standard regardless.
• What's required for Type 7 volatile extraction?. Type 7 volatile-solvent extraction requires a closed-loop system — solvent contained throughout the extraction cycle, recovered, and recirculated rather than vented — certified by a licensed Professional Engineer at installation and re-certified after material modifications, per the DCC closed-loop extraction systems checklist and CCR 17200–17210. Facility compliance with the California Fire Code (Group H occupancy), Building Code, and Mechanical Code is mandatory, with explosion-proof electrical classification (C1D1/C1D2), LEL gas detection with automated shutdown, and ventilation engineering per NFPA 1. Local fire authority pre-installation review and post-installation acceptance are required before operation, and OSHA PSM (29 CFR 1910.119) applies where solvent quantities cross the threshold.
• What are Batch Production Records (BPR)?. BPRs are the contemporaneous records under CCR 17304 of every manufactured batch — weights, times, operators, equipment, in-process control values, deviation references, yield reconciliation, and QC release disposition. Each BPR must be retained for the minimum CCR 17306 period; we hold all manufacturing records to the broader CCR 15037 seven-year standard so a single retention rule governs the document vault. BPRs are the primary evidence DCC reviews when investigating complaints, product embargoes, or recalls — a back-filled BPR (handwriting and ink consistency are checked) widens recall scope and signals systemic process failure.
• How long does building a QMS take?. Simple Type N infusion-only operations: 4–6 weeks. Type 6 non-volatile extraction: 6–10 weeks. Type 7 volatile-solvent extraction with 10+ SKUs: 8–14 weeks because closed-loop SOPs, PE-certification integration, and OSHA PSM coordination add scope. Multi-product Type S shared-use facilities: 12–20 weeks because each tenant needs its own PQP/MMP/BPR set. Timeline depends on SKU count, license type, and how much existing documentation maps cleanly onto the DCC PQP/MMP/BPR checklists.
• What's CAPA and why does it matter?. Corrective and Preventive Action is the systematic process for addressing deviations, complaints, test failures, equipment issues, and adverse event reports. It is required under cGMP expectations (21 CFR Part 111), strongly expected under the CCR 17200-series GMP framework, and the first document DCC inspectors review after any adverse event. A well-maintained CAPA log with named approvers, completion deadlines, root-cause analysis (5-Why or fishbone), and effectiveness verification is the single strongest inspection-readiness indicator a facility can produce.
• Do you handle recall readiness?. Yes — the Recall SOP under CCR 17408 and BPC 26131, plus annual mock-recall execution, are core deliverables of the manufacturing QMS. California cannabis recalls are initiated by DCC under CCR 17408 or voluntarily by the licensee under BPC 26131; both require documented traceability through METRC packages and the BPR, customer notification templates, product retrieval and quarantine, destruction documentation, and DCC reporting. Average voluntary recall cost is roughly $320K; mandatory recalls run 2–4× that, and the difference between a targeted and a broadcast recall is whether batch genealogy can isolate affected lots.
• What about labeling and packaging compliance?. Full label compliance is a separate but related service (see Product & Label Compliance) covering primary panel, information panel, government warning, universal symbol, allergen disclosure, vape labeling under AB 1894, and child-resistant packaging. In manufacturing QMS work, we establish the CCR 17305 release procedure that verifies label compliance before packaging — including the FDA Big 9 allergen statement (milk, eggs, fish, shellfish, tree nuts, peanuts, wheat, soy, and sesame under the FASTER Act) for any infused or edible product. An out-of-compliance label is a release blocker and an immediate Notice-to-Comply trigger if it reaches retail.
• Can you help prepare for a DCC inspection?. Yes — pre-inspection readiness is a core deliverable of every manufacturing QMS engagement. We run mock inspections against the DCC PQP, MMP, BPR, closed-loop extraction, sanitation, and allergen checklists; review training and equipment qualification records; and rehearse staff on the questions inspectors actually ask. The most common inspection findings are BPR completeness gaps (missing signatures, blank in-process check fields), SOP-to-practice mismatch (the SOP describes a process never run), and training documentation gaps — all areas the QMS specifically closes before the regulator arrives.
• Do you work with appellation or heritage cultivators?. For cultivation-side operations, see our cultivation compliance work. Some manufacturers source from heritage or CDFA appellation-of-origin cultivators and need incoming-material specifications, chain-of-custody documentation, and PQP language preserving the appellation claim through processing. We build incoming-material SOPs and BPR fields that verify the appellation chain so the marketing claim survives DCC labeling review and the Product & Label Compliance gate.
• What's the cost of a full manufacturing QMS build?. Scope-dependent and fixed-fee against a written scope. Type N infusion-only or Type P packaging-only: $8,000–$18,000. Type 6 non-volatile extraction: $12,000–$25,000. Type 7 volatile-solvent full build (PQPs + MMPs + closed-loop extraction SOPs + PE coordination + OSHA PSM where applicable): $25,000–$60,000 depending on facility complexity and SKU count. Ongoing QMS maintenance via retainer: $800–$2,500 per month, payable in milestones.
• How do you coordinate with our extraction engineer?. For Type 7, we work directly with your licensed Professional Engineer, the local fire authority (AHJ), and the equipment vendor. We translate the DCC closed-loop extraction systems checklist and CCR 17200–17210 into engineering specifications, review PE-stamped plans for compliance, support vendor communications on installation/operational/performance qualification, and ensure the closed-loop PE certification (and re-certification after material modifications) is on-site for inspection. We do not replace your PE — we ensure the engineering record integrates cleanly with the DCC application packet, the QMS, and the Form DCC-LIC-027 modification gate when the system changes.

Manufacturing QMS work breaks cleanly into four operational areas. These are named responsibilities — not coordination tasks, not support roles, not ‘keep you informed’ meetings. Where we own, we draft, build, train, and hand over a working system. Where you own, we coordinate in support but the decision remains yours. The engagement letter names both sides of the line before fieldwork opens.

When DCC asks ‘why did you recommend this?’, we cite the regulation. When an auditor asks ‘what’s this based on?’, we cite the CCR subsection. When diligence counsel reviews the quality manual, the chain from SOP to statute is visible in the document header. The specificity matters — it is the difference between advisory opinion and defensible manufacturing work.

California cannabis manufacturing operates at the intersection of four authority layers: state statute (the Business & Professions Code under MAUCRSA), state regulation (the CCR Title 4 Division 19 manufacturing series at 17200–17418), federal GMP adjacency (21 CFR Part 111 for dietary supplements, Part 210/211 for drugs), and process-safety authority (NFPA 1 fire code and OSHA PSM where solvent quantities trigger the standard). Each form, each SOP, each batch record below resolves to one of those four.

Business & Professions Code (statute)

• BPC 26013. DCC's general authority to adopt manufacturing regulations, conduct inspections, and enforce against licensees. Every CCR 17000-series rule traces back to this grant of authority and every inspector visit operates under it.
• BPC 26101. Product standards including THC potency limits, contaminant thresholds, child-resistant packaging triggers, and labeling. The release SOP in the QMS verifies each finished batch against the BPC 26101 standard before product leaves the facility.
• BPC 26131. DCC recall authority and the voluntary-recall framework. Codifies the obligation to remove from commerce any product that fails to meet product standards, supports the recall SOP under CCR 17408, and is the statutory floor a recall plan must satisfy.

California Code of Regulations Title 4 Division 19 (DCC operational rules)

• CCR 17200–17210. The closed-loop extraction system rules covering volatile solvents, asphyxiating solvents, flammable liquids, permissible extraction types, system design and engineering, and continued PE certification of the closed-loop system. The single most operationally consequential subsection for any Type 7 facility.
• CCR 17302. Sanitation and environmental monitoring — the GMP facility-standards suite covering construction, lighting, ventilation, water and sewage, plumbing, pest control, sanitation procedures, personnel hygiene, restroom and handwashing, and waste management. The first set of conditions inspectors verify on a manufacturing visit.
• CCR 17303. The Product Quality Plan and Master Manufacturing Protocol requirements. PQP identifies, prevents, monitors, and remediates risks of adulteration, misbranding, lab failure, or QA failure for each product; MMP codifies the written instructions for each formulation and batch — ingredients, equipment, parameters, QC checks, yields.
• CCR 17304. Batch Production Record requirements: contemporaneous documentation that the manufacturer used the monitoring methods identified in the PQP, followed the instructions in the MMP, captured actual values during monitoring, and documented QC review and release/reject of the finished product. The BPR is the per-batch evidence the entire QMS produces.
• CCR 17305. Labeling and release. Final release step verifies label compliance against BPC 26101 and the packaging-labeling rules before product leaves the facility — out-of-compliance label is a release blocker, not a downstream fix.
• CCR 17306. Manufacturing record retention. We hold all PQP, MMP, BPR, deviation, CAPA, training, and equipment qualification records to the broader CCR 15037 seven-year standard so the archive answers any inspection, diligence, or recall scope question without rebuilding under subpoena.
• CCR 17408. Recall procedures and DCC recall-authority coordination. Defines the licensee's obligation to maintain a written recall plan, place METRC holds, notify customers, document destruction, and report to DCC.
• CCR 15037. The seven-year record retention rule applied across DCC licensees. Our manufacturing QMS retention policy matches CCR 15037 rather than the narrower CCR 17306 minimum so a single retention standard governs the whole document vault.
• CCR 15039. Employee training and qualification standards. Anchors the role-based training matrix, competency assessments, and retraining triggers that close the GMP personnel-procedure loop.

DCC Forms and operational documents

• DCC PQP, MMP, and BPR checklists. The DCC publishes specific checklists for each leg of the documentation triangle — the PQP guidance and PQP FAQs, the Master Manufacturing Protocol checklist, and the Batch Production Record checklist. Each engagement is built and audited against these checklists; passing them is the operational definition of an inspection-ready QMS.
• DCC closed-loop extraction systems checklist. The DCC's checklist covering volatile-solvent use, asphyxiating-solvent use, flammable liquids, permissible extraction types, system design, and continued certification. Required reading for every Type 7 PE certification engagement.
• DCC allergen guidance. Adapts FDA major-food-allergen rules to cannabis edibles and infusions covering the FDA Big 9 (milk, eggs, fish, shellfish, tree nuts, peanuts, wheat, soy, and sesame under the FASTER Act). Each PQP for an edible or infused product cites this guidance and the corresponding allergen control program.
• Form DCC-LIC-019. Consolidated Standard Operating Procedures form. The single SOP package replacing the legacy Forms 015–020 in February 2022; required at application for cultivators and on file for all other license types before operations begin. The QMS document index keys directly to the DCC-LIC-019 structure.
• Form DCC-LIC-027. Post-issuance notifications and modifications form — not part of the initial application packet, but the gate for premises changes, equipment modifications that touch the closed-loop system, ownership changes, and license-type amendments. Material modifications to the extraction system trigger PE re-certification and a Form 27 filing.
• remediation@cannabis.ca.gov. The DCC pre-approval contact for failed-test remediation. Manufacturers cannot self-initiate remediation of a failed batch; the email channel is the regulatory gate, and the remediation SOP in the QMS routes every failed-test event through it.

Federal-adjacent and process-safety authorities

• FDA cGMP (21 CFR Part 111). Dietary-supplement current good manufacturing practice — the federal framework most-adjacent to cannabis manufacturing and the de-facto standard institutional diligence reviewers apply. Our QMS framework translates directly to Part 111 so the gap is small the day federal rules permit interstate commerce.
• FDA cGMP (21 CFR Part 210/211). Drug current good manufacturing practice. Relevant for operators on a pharmaceutical-track product or anticipating future federal pathway changes; Part 211 record-retention and process-validation expectations exceed Part 111 and CCR 17000 and shape the upper bound of QMS rigor.
• NFPA 1 (Fire Code). Fire code requirements for volatile-extraction facilities including Group H occupancy, sprinklers, flame-spread ratings, ventilation rates, and explosion-proof electrical classification. Coordinated with local fire authority approval, which is required pre-installation and post-installation for every Type 7 closed-loop system.
• OSHA PSM (29 CFR 1910.119). Process Safety Management standard, triggered for facilities above the solvent-threshold quantities. Drives the process hazard analysis, mechanical-integrity program, and management-of-change discipline that the QMS inherits where solvent inventory crosses the threshold.

How the authorities interact

BPC 26013 and 26101 set the statutory frame; the CCR 17200-series operationalizes it through PQP, MMP, BPR, sanitation, labeling, retention, and recall rules. Each DCC checklist (PQP, MMP, BPR, closed-loop extraction, allergen guidance) is the auditable interpretation of those CCR sections. NFPA 1 and OSHA PSM run alongside for Type 7 facilities and convert the regulatory floor into building, fire, and process-safety engineering. 21 CFR Part 111 sits one layer above — today aspirational, but the diligence standard institutional capital applies and the framework the QMS is built to so the gap is small when federal rules change. If any one layer falls out of sync — a PE certification stale, a BPR back-filled, an allergen statement missing, a recall plan untested — the whole stack is exposed at the next inspection or diligence pass.

Deliverables are what we produce. Outcomes are what those deliverables enable — the specific operational benefits you get from having this work done right. Manufacturing QMS outcomes are measured in defensible batches, diligence-ready quality manuals, and recall capability that keeps targeted events from becoming facility-wide catastrophes.

Twelve outcomes, in detail

• Product Quality Plans that pass DCC review. One PQP per product identifying the adulteration, misbranding, lab-failure, and QA-failure risks at every step under the DCC's product-quality-plan framework. The PQP is the structural equivalent of a HACCP plan and the document inspectors test against the actual process; ours hold up because they describe the process the floor actually runs.
• Master Manufacturing Protocols per formulation. Each MMP names the type and amount of every ingredient, every process parameter (temperature, time, pressure), every QC checkpoint, and the yield-reconciliation arithmetic that ties inputs to outputs plus waste. Per the DCC checklist, the MMP is the recipe-plus-process specification that prevents formulation drift between batches.
• Batch Production Records that survive cross-examination. BPR templates that capture input COA, METRC tag, operator signoff at each critical control point, in-process check values, deviation references, yield, and QC release disposition on one auditable record. Trained for contemporaneous completion — not back-filled at end of shift — because handwriting and ink consistency are the first things inspectors check.
• SOPs for every unit operation. Receiving, extraction (hydrocarbon, CO₂, ethanol where applicable), winterization, distillation, infusion, mixing, homogenization, filling, packaging, labeling, release, and shipping — each written to your actual floor under the GMP framework adapted from food-industry practice. Templates fail DCC review and produce Notices to Comply on first inspection; the SOPs we write reflect the equipment, supplier, and staffing actually in place.
• CAPA procedure that closes the loop. Corrective and preventive action workflow meeting cGMP expectations under 21 CFR Part 111, with 5-Why and fishbone root-cause frameworks, named approvers, completion deadlines, and effectiveness verification through follow-up monitoring. The CAPA log is the first document inspectors review after any adverse event and the strongest single inspection-readiness indicator.
• Complaint and adverse event handling SOP. Documented intake, triage, investigation, and response procedure for retailer complaints, consumer inquiries, and adverse event reports. This is the first evidence source for a potential recall under CCR 17408 and BPC 26131; weak complaint handling is the most common reason a targeted recall expands into a facility-wide event.
• Equipment qualification packages (IQ/OQ/PQ). Installation Qualification, Operational Qualification, and Performance Qualification for every piece of processing equipment — including the closed-loop extraction system PE certification for Type 7 and the re-certification record for material modifications. Required for cGMP adjacency, strongly expected at DCC inspection, and a non-negotiable diligence checkpoint.
• Closed-loop extraction compliance for Type 7. SOPs covering closed-loop solvent recovery (recirculated, not vented), residual-solvent testing protocol, solvent-inventory reconciliation (purchased vs. recovered plus waste — the gap is diversion or system leak), and the operator-training records the DCC checklist demands. Coordination with the licensed PE on certification, with the local fire authority on Group H occupancy and ventilation, and with OSHA PSM where solvent quantities cross the threshold.
• Allergen control program for edibles and infusions. Identification of all FDA Big 9 allergens (milk, eggs, fish, shellfish, tree nuts, peanuts, wheat, soy, and sesame under the FASTER Act) in incoming components, segregation in storage, scheduled production runs to minimize cross-contact, validated cleaning between allergen profiles, and the “Contains” statement for labeling. Critical for Type S shared-use facilities where prior-tenant allergens contaminate “free-from” product without validated cleaning.
• Sanitation and environmental monitoring SOP. Cleaning and sanitization protocols, food-contact surface materials (stainless and food-grade plastics), pest control program, personnel hygiene, restroom and handwashing standards, and waste management — the GMP facility-standard suite the DCC expects under the manufacturing regulation framework.
• Product testing and release SOP. Lab coordination with your Type 8 testing partner, COA review against PQP specifications, out-of-specification investigation, and release-disposition authority documented in the BPR. Where a batch fails the remediation pathway is initiated only after DCC pre-approval through remediation@cannabis.ca.gov — never as a unilateral operator decision.
• Recall capability that keeps events targeted. Recall SOP under CCR 17408 and BPC 26131 with METRC hold protocol, customer notification templates, destruction documentation, DCC reporting workflow, and an annual mock-recall drill with written report. Targeted recalls cost an average of $320K and stay contained; broadcast recalls run 2–4× that and put the license at risk.

How we measure

Outcomes are measured at three checkpoints: documentation completeness on go-live (PQP for every product, MMP for every formulation, BPR template approved by QA, all SOPs cited to a CCR subsection), inspection performance (a mock inspection executed before any real DCC visit, deviations and CAPAs logged and closed, training records current), and recall-capability proof (the annual mock recall executed, METRC hold placed within 24 hours, customer notification drafted from the template, batch genealogy traced through input COA to retailer disposition). Every measurement is on the record so a buyer's diligence two years later sees the work, not just the result.

Post-engagement review

30 days after go-live we run a 60-minute post-engagement review covering the QMS in operation, the open CAPAs, the deviation register, the document-control queue, and the next mock-recall date. Where the engagement continues into the Ongoing Compliance Retainer this becomes the kickoff for the steady-state cadence; where it does not, the QMS, training records, and indexed document vault transfer to your QA team with a one-page handoff brief naming the maintenance owner, the quarterly review schedule, and the renewal checkpoint.