Create your plan: Preventive control plan for cannabis extracts and edible cannabis

On this page

Create your plan

Before you start creating your preventive control plan, it's important that you have key members of your team in place who understand your cannabis production process, including the ingredients, equipment, and packaging used to produce your cannabis extract or edible cannabis. Your team should include a quality assurance person (QAP), as well as other personnel who can support them with knowledge and expertise on hazard identification, the control of hazards and your production process.

Recommended steps to create your preventive control plan are as follows.

Step 1: Hazard identification, analysis and control measures

Step 2: Critical control points and critical limit determination

Step 3: Monitoring procedure for each critical control point

Step 4: Corrective action procedures for each critical control point

Step 5: Verification procedures for implementing your preventive control plan

Step 6: Supporting documentation

Important: You should tailor the information in your preventive control plan to your specific operations and products.

Conduct hazard analysis

You must identify and analyze the hazards that present a risk of contamination to the cannabis or ingredients during the production of cannabis extracts or edible cannabis.

This section describes how to identify and analyze hazards in the production of cannabis extracts or edible cannabis, including:

Types of hazards

There are 3 different types of hazards:

Biological hazards

Biological hazards include microorganisms such as bacteria, viruses, parasites, fungi, and moulds. Some microorganisms, such as Salmonella spp., Listeria monocytogenes, Bacillus cereus, E. coli O157:H7 and Campylobacter jejuni, are harmful and can cause illnesses by their presence alone. Other microorganisms, such as Clostridium botulinum and Staphylococcus aureus, produce harmful toxins. For example, botulism caused by Clostridium botulinum can have severe health consequences.

Examples of sources of biological hazards include:

Chemical hazards

Chemical hazards may be naturally occurring or manufactured and can be introduced during any stage of cannabis extract or edible cannabis processing. For example, allergens may be introduced either by being present in an ingredient or as a part of an ingredient, or through cross-contamination during processing.

Examples of chemical hazards may include:

Physical hazards

Physical hazards include unwanted materials that may be introduced anywhere along the production chain, from primary production up to and including packaging and labelling. Unwanted materials can be introduced by anything or anyone coming in contact with the cannabis, cannabis extract, or edible cannabis, such as people who handle cannabis, or during processing, transportation or storage. The unwanted materials are considered hazardous if they can result in illness or injury to anyone who consumes or uses the cannabis extract or edible cannabis.

Examples of physical hazards include:

Identify hazards

To properly identify a hazard, you need to understand your cannabis extract or edible cannabis product and all its processing steps, be knowledgeable about the hazards associated at each processing step and have a good understanding of how they can be controlled.

Hazard identification can be based on:

Once identified, a list of biological, chemical and physical hazards that may reasonably be expected or likely to occur should be created. These hazards may come from:

In the list of identified hazards, you should include the name of the pathogen (for example, Listeria monocytogenes) or the type of physical hazard (for example, glass fragment), the conditions that are associated with it (for example, presence, survival, growth, or contamination), and the reason for the hazard. For example:

As part of your preventive control plan, documents must be included to explain how you've identified the hazards associated with the cannabis extract or edible cannabis. These may include:

Analyze and evaluate hazards

With the hazards identified, you will need to determine how likely each hazard is to occur and how severely it may affect the consumer's health. You will also need to record why a hazard isn't likely to occur, and if a hazard is likely to occur, why it is or is not significant.

When evaluating the likelihood that a hazard will occur, consider:

When evaluating the severity of a hazard, consider the:

A significant hazard is a hazard that is likely to occur and would severely affect the health of consumers if it's not controlled. If you miss a significant hazard, it won't be controlled leading to the potential for a significant impact on product quality and safety.

Determine control measures

For all potential hazards you've identified, you must determine how you will control each hazard so that it's prevented, eliminated or reduced to an acceptable level. For each control measure, you must have evidence that the control measure is effective.

The control measures should be described as follows:

Evidence could include:

The type and amount of evidence needed to demonstrate effectiveness of a control measure (or a combination of control measures) depends on the type of control measure and on the nature of the hazards. Assess each control measure on a case-by-case basis.

Determine critical control points and their critical limits

As part of your preventive control plan, you need to include a description of the critical control points, the related control measures and the evidence that the control measures are effective.

A critical control point is a step in your process where a control measure is applied with clear critical limits. A critical control point is essential to prevent, eliminate or reduce to an acceptable level the identified hazards.

Critical limits are the measurable or observable pre-set values or criteria that must be met at a critical control point to control the identified hazards.

A critical control point must have realistic and appropriate critical limits that can be monitored and measured.

Determine critical control points

After conducting your hazard analysis, determine if there are any critical control points in your process.

In general, critical control point determination involves identifying and characterizing the hazards, the control measures, and the processing steps where the control is applied.

To determine if a step in your process is a critical control point, review the hazard analysis that you conducted and consider the following information for each hazard identified at a process step.

  1. If a control measure at a process step doesn't exist to control a hazard and:
    • you have determined that this step in your process isn't necessary for product safety, then this step in your process isn't a critical control point
    • you have determined that this step in your process is necessary for product safety, then you need to modify the step, process or product so that this step in your process does not affect the safety of the product
      • Control measures must exist if a step in your process is a critical control point
  2. If a control measure exists at a step in your process and this step is specifically designed to eliminate or reduce the likely occurrence of a hazard to an acceptable level, then this step is a critical control point
  3. If you have determined that the failure of a control measure at a step in your process is unlikely to increase the hazard to an unacceptable level, then this step in your process isn't a critical control point
  4. For a hazard identified at a step in your process, if a subsequent step in your process will eliminate the hazard or reduce it to an acceptable level, then the initial step isn't a critical control point

A critical control point can also be a step taken to control the identified hazard directly. This can be a cooking step to control biological pathogens, a metal detector to detect metal fragments, or cooling or freezing ingredients or products to control pathogens.

In a typical facility, the location of hazards and the number of critical control points depend on the equipment, site layout, ingredients, processes used, and other factors.

Examples of processing steps that may be considered critical control points are:

There is no set number of critical control points required in a preventive control plan. Depending on the products and activities at your site, there may not be any critical control points in your preventive control plan. Critical control points must be determined for each specific hazard in the cannabis extract or edible cannabis processing and handling system and be appropriate to that specific system.

Another way of identifying critical control points is the use of a decision tree where a series of questions guides you through this process. For example, see a decision tree developed by Codex Alimentarius, an international food code.

Establish critical limits for a critical control point

For each critical control point in your process, you must establish your critical limits or criteria that prevent, eliminate or reduce the hazard to an acceptable level.
Critical limits should be:

Evaluating critical limits should produce an immediate result to ensure a quick decision on whether the identified hazard is controlled to an acceptable level. It is important that your critical limits:

Critical limits may be quantitative (for example, length, height, area, volume, weight, speed, time, temperature, humidity) or qualitative (for example, other types of properties that can be confirmed by a visual inspection, such as color of the product or presence of air bubbles). Critical limits based on qualitative data should be supported further with descriptions or instructions that help those responsible for monitoring the critical control point understand the critical limit and ensure consistent application.

Examples of criteria for a critical limit:

You can obtain criteria from many sources:

Monitor critical control points

You must develop procedures to monitor your critical limits at each critical control point.

Monitoring procedures describe any tests, measurements or observations of the critical limits that will be conducted to assess whether:

Your monitoring procedures should:

Types of monitoring activities may include:

Important: You will need to consider the time required to obtain results when deciding what monitoring procedures should be used in a critical control point. Rapid tests are preferable for monitoring procedures taking place on dynamic processing lines.

Corrective action procedures

You must develop corrective action procedures for every critical control point. They are the steps to be taken to address any deviations from the critical limits or the control measures in the preventive control plan.

When your control measures or processes don't meet a critical limit, it indicates that a product safety hazard may have occurred, and that unsafe products may have been produced. Thus, corrective actions must be immediate and must trigger an automatic review of the preventive control plan.

Your corrective action procedures should:

Corrective action procedures are required for each critical control point. Corrective actions are specific for each hazard and for each critical control point.

Every written corrective action procedure should answer basic questions about who, what, when, and how to document the corrective actions.

The typical sequence of events involved in a corrective action by licence holders is as follows.

  1. Re-establish control, investigate and identify all affected lots or batches of product and any unsafe product that entered the trade supply. For example:
    • stop the line or process
    • identify and segregate affected product
    • start investigating, identifying, following up and conducting a recall if an unsafe cannabis product has entered the marketplace
    • inform regulatory officials as appropriate
  2. Find the root cause of the deviation and prevent recurrence
    • investigate and determine what went wrong
    • adjust the process to bring it back under control
  3. Assess if the product is still safe to consume or use and how the product will be dealt with after the assessment
  4. Determine whether modification of your plan is necessary
  5. Document the details including observations, corrective actions taken, and control measures to prevent recurrence

Verify your preventive control plan

You must develop procedures for verifying the implementation and effectiveness of your preventive control plan.

Verification procedures should describe what you will do to verify or to confirm that all control measures, especially those identified as critical control points, and other parts and processes in your preventive control plan are implemented consistently and are effective in ensuring safe and compliant cannabis extracts or edible cannabis.

Verification procedures don't only involve the critical control points but rather the preventive control plan as a whole.

The procedure includes details such as:

All critical control point-related activities (critical limits, critical control point monitoring, and corrective actions) necessary to ensure compliance with the preventive control plan must be verified. This includes establishing that:

It may be necessary to check the adequacy of monitoring and to provide confirmation that the critical control point is, in fact, controlling the hazards by performing additional sampling and testing.

One aspect of verification activity is the review of all critical control point records, including monitoring records, corrective action records, and calibration records. Verifying records ensures that they're prepared and implemented according to the procedure described in the preventive control plan. This includes evaluation to ensure:

Examples of verification activities are:

Cannabis type-specific requirements

In your preventive control plan, you must describe how you will ensure that specific requirements for cannabis extracts and edible cannabis listed in this page are met.

This section includes restrictions or limits and conditions that cannabis extracts and edible cannabis are subject to:

Cannabis extracts


Ingredients permitted in your cannabis extracts are:

Ingredients not permitted in your cannabis extracts are:

However, there are some exemptions to these prohibitions:

Additionally, for inhaled cannabis extracts, ingredients – other than flavouring agent – must comply with a standard set out in one of the publications referred to in Schedule B to the Food and Drugs Act.

Uniform distribution

The cannabinoids and terpenes must be uniformly distributed throughout the cannabis extract. For example, in a lot or batch of bottled cannabis extract, the amount of THC in every bottle should be the same.

Edible cannabis


Ingredients permitted in your edible cannabis are:

Ingredients not permitted in your edible cannabis are:

Ingredients permitted in your edible cannabis with conditions are:

Hermetically sealed containers

The components of edible cannabis products that are packaged in hermetically sealed containers (that is, containers that prevent the entry of micro-organisms) must have, at a temperature of 22 +/- 2°C:


The requirements for the irradiation of edible cannabis are:

Describe your measures to meet the cannabis-type specific requirements

As applicable to your activity and operations, your preventive control plan should include:

For example, written procedures for the production of edible cannabis that meets the requirements above would include information such as:

Page details

Date modified: