In the early years of the Massachusetts legal adult-use cannabis market, the Cannabis Control Commission failed to prevent the sale of products with expired test results, ensure that positive pesticide tests were promptly reported and provide adequate cybersecurity training to CCC staff.
State Auditor Diana DiZoglio audited the CCC from Jan. 1 2019, through the end of 2020, before releasing her report on Sept. 26, 2023. The report portrays the CCC as a nascent state agency that was still trying to get the kinks out of its system under the watchful gaze of the Auditor’s Office. Today, the commission is still making regulatory changes as it faces leadership problems.
The CCC was created in fall of 2017, about a year after voters legalized adult-use cannabis in the state, so the auditor’s report covers the agency’s second and third year of operation.
By the end of December 2020, there were 212 final licenses for recreational dispensaries and 85 final medical-use licenses. Since then, those numbers have exploded with 499 retail licenses and 101 medical-use licenses.
During the period in which the audit took place, there were only two independent testing labs (ITL) in operation in the state. Through the audit period, the two ITLs performed 1,512,325 individual tests for potency and contaminants. The typical turnaround time for those tests was about four to 12 days, according to the auditor’s report.
The first year of the audit covered the vape scare, which involved discovering that some concentrates that contained Vitamin E acetate could be dangerous for users. This resulted in vape cartridges being pulled from stores and demand to drop off. The second year brought the COVID-19 pandemic, which also exacerbated testing lab turnaround time.
Shortly after the auditor’s examination period, testing delays in Massachusetts slowly increased as more producers opened for business, to the point where it was often taking up to a month to process test results. Those delays eventually abated as more licensed testing labs came online. Currently 14 labs are in operation.
Old pot sold, delayed pesticide results
The audit found that 1,517 packages of cannabis products out of 160,625 were sold more than a year after they had last been lab tested. State regulations require that all products be retested or processed into a concentrate within a year of its original test.
Since the end of 2020, Massachusetts’ wholesale supply has exploded, leading to a lengthening of time between harvest and testing.
The auditor’s report recommends that the CCC update its track and trace system to allow for tracking based on the age of the product. In the CCC’s response to the audit, the commission said that it already made those changes.
“The Commission has implemented controls – independent from the audit’s finding and recommendations – since 2020 to ensure products are sold within the test validity dates,” said the response.
The report also found that the CCC failed to ensure that cannabis operators and testing labs report positive pesticide tests within 72 hours. More than a third of the positive pesticide tests that occurred during the auditor’s reporting period took four to 16 days before they were reported to the state.
Once again, the commission said that it had already made improvements to how it tracks test results.
“The Commission has enacted changes,” said the CCC’s response. “In 2021, the Commission staff worked with its vendor, Metrc, to modify the seed-to-sale system to ensure that untested product cannot go to retail.”
The auditor was less convinced with this explanation and reiterated her recommendation.
“In its response, CCC asserts that during the audit period, controls were in place and working as intended. We acknowledge that CCC may have been aware of these instances of late or missing reporting, but the instances were only detected by an inspection after the event had already occurred,” said the report. “We believe that CCC needs to strengthen its existing process by implementing additional preventative controls, which should be designed to prevent the event from occurring in the first place.”
Cybersecurity lacking
Finally, the auditor’s report noted that at the time of their review, the CCC had not yet adopted cybersecurity training awareness. Once again, the CCC stated that it had already corrected the matter, which the auditor accepted.
“The Commission acknowledges this finding,” said the CCC response. “The Commission implemented cybersecurity training for all employees in February 2020. All new staff members, including Commissioners, are now required to complete initial training within 30 days of their first day of work. The Commission has quarterly cybersecurity training and random testing, through the KnowBe4 cybersecurity training platform.”
Despite the increased frequency of cybersecurity training, the report did not cover a large data breach that occurred earlier this year when a commission employee “inadvertently” released personal information about its staff to a reporter.
