Implementing, maintaining and record keeping: Preventive control plan for cannabis extracts and edible cannabis

On this page

• Implementing your plan
• Maintaining your plan
• Record keeping

Implementing your plan

Once your preventive control plan is developed, you need to implement it into your day-to-day operations.

This involves:

• staff training
• following your preventive control plan as written
• creating and keeping records such as service contracts, processing records, packaging records, and other day-to-day records, which serve as evidence that you have implemented your preventive control plan
• verify that your preventive control plan is implemented as written and is effective in preventing hazards

Maintaining your plan

You must continuously and periodically review, improve, and revise your preventive control plan as necessary so that your preventive control plan reflects the current practices and operation of your facility and managing risks associated with the production of your products.

Your preventive control plan needs to be reassessed and amended when:

• something is new or has changed
• for example, with the regulatory requirements, incoming ingredients, product formulation, production line or equipment, production flow or processing step
• something went wrong or a problem has been identified
• for example, a deficiency or deviation observed during in-house monitoring or verification procedures, observations identified by Health Canada, consumer complaints, product recall, unsatisfactory laboratory result or inspection

If a reassessment has occurred, you should record this event describing the reassessment activity, its result, and the revisions made, if any, as a best practice.

Record keeping

You must keep records or documents of the following:

• supporting documents you use as evidence when creating your preventive control plan, for example:
• outcome of your hazard analysis, determination of critical control points and critical limits
• evidence that your control measures are effective
• regulatory standards and guidelines
• expert opinions and scientific research
• description of industry practice
• standard operating procedures
• records used to develop monitoring and verification procedures
• supporting documents you use as evidence that your preventive control plan has been implemented, for example:
• records you use to capture monitoring data at each critical control points, for example, time and temperature readings
• processing-related records
• verification activity records
• analytical testing records
• records of corrective actions taken
• management review of your plan

You must keep each record for at least two years after the day on which it was created.

You'll generate a number of different types of records, suitable to your operations. These must be made available for review by Health Canada.

Best practices you should adopt for both hard copy and electronic records:

• maintain templates that include all required information fields
• records are legible, permanent and accurately reflect the actual event, condition or activity
• each entry on a record is made by the applicable person at the time that the specific event occurred
• completed records are signed and dated by the applicable person
• unit of measure is indicated for numerical recordings
• no scratch-outs, white outs, arrows or ditto marks
• make a single strike-out line on a mistake in recording data so that the original entry is still legible
• initial the correction

If using electronic records:

• only authorized individuals should access and use the system, electronically sign a record, access the operation or computer system, alter a record, and perform operations
• follow good practices for electronic signature, such as:
  • the process used to make the signature is under the sole control of the person making the signature
  • the electronic signature is clearly linked with the electronic record
  • controls are in place to ensure that electronic signatures and their links to records cannot be removed, copied or otherwise manipulated
  • the identity of persons authorized to use electronic signatures is documented