Oregon's Framework for Regulating Marijuana Should be

Secretary of State Dennis Richardson

Audits Division Director Kip Memmott

Oregon Liquor Control Commission

Oregon Health Authority

Oregon’s Framework for Regulating Marijuana

Should Be Strengthened to Better Mitigate Diversion

Risk and Improve Laboratory Testing

January 2019

2019-04

This page intentionally left blank

January 2019

Oregon Liquor Control Commission, Oregon Health Authority

Oregon’s Framework for Regulating Marijuana Should Be Strengthened to

Better Mitigate Diversion Risk and Improve Laboratory Testing

Report Highlights

Gaps in Oregon’s developing marijuana regulatory framework increase the risk of legal marijuana diverting to

the black market, especially in the medical marijuana program. To improve marijuana laboratory testing and

protect public health, the state should consider requiring testing for heavy metals and microbiological

contaminants, enhance test oversight, and ensure labs meet accreditation standards.

Background

Voters approved Measure 91 in 2014, legalizing the production and sale of recreational marijuana in Oregon.

However, marijuana remains illegal federally, and federal officials have expressed serious concerns about

marijuana from Oregon crossing into other states. The Oregon Liquor Control Commission (OLCC) regulates the

recreational marijuana market, while the Oregon Health Authority (OHA) oversees medical marijuana and

marijuana lab testing rules. As of November 2018, retail sales had generated $207 million in tax revenue.

Purpose

This audit’s purpose was to determine whether Oregon has adequate controls to deter the diversion of legal

marijuana to the black market and to oversee marijuana laboratory testing to ensure test results are accurate.

Key Findings

1. OLCC is still establishing a regulatory framework for recreational marijuana and has put many controls

in place, such as requiring seed-to-sale product tracking and surveillance cameras. However, with no

cap on the number of licenses and more applications than expected, staffing and inspections have not

kept pace. As a result, only 3% of retailers and 32% of growers have had a compliance inspection.

2. Structural weaknesses in the medical marijuana program greatly increase the risk of diversion. In

contrast to OLCC, OHA lacks the authority to put important controls in place, such as requiring medical

growers to have surveillance cameras. The agency has only four permanent staff to inspect roughly

14,000 grow sites and has struggled with decreasing revenues, turnover, and performance management.

3. All recreational marijuana in Oregon must be tested for pesticides and solvents, but most medical

marijuana is not required to be tested. Also, OHA does not require heavy metal and microbiological

testing, in contrast to some other states. These contaminants could pose a risk to consumers.

4. Without a mechanism for verifying test results, Oregon’s marijuana testing program cannot ensure that

test results are reliable and products are safe. Limited authority, inadequate staffing, and inefficient

processes reduce OHA’s ability to ensure Oregon marijuana labs consistently operate under

accreditation standards and industry pressures may affect lab practices and the accuracy of results.

Recommendations

OLCC and OHA agreed with all 23 of our recommendations; for three of them, OHA indicated it would be unable

to take action without further statutory authority. The agencies’ responses are included at the end of the report.

Oregon Secretary of State | Report 2019-04 | January 2019 | Page 1

Introduction

While marijuana is still federally illegal, Oregon voted to legalize medical marijuana in 1998 and

recreational marijuana sixteen years later. Marijuana use was first legalized only for patients

with a qualifying medical condition. The measure established a patient registry now

administered by the Oregon Health Authority (OHA), an agency committed to protecting public

health. Though the state’s involvement in the medical market expanded in subsequent years,

regulatory controls remained limited. Voter legalization of recreational marijuana in 2014

created an entirely new regulated market in Oregon and has led to numerous changes to state

laws and rules, expanding state oversight in the years since the measure’s passage.

The Oregon Liquor Control Commission (OLCC) is charged with regulating recreational

marijuana in Oregon, including licensing recreational marijuana growers, processors, and retail

shops. The state’s medical marijuana system falls under the oversight of the Oregon Medical

Marijuana Program (OMMP), housed within OHA. OMMP registers medical marijuana patients,

caregivers, and growers. OHA also writes the rules for marijuana testing (which includes testing

for potency, pesticides, and other contaminants), and oversees the accreditation of marijuana

testing laboratories.

Federal law enforcement officials have expressed concerns about legal marijuana from Oregon

being diverted to the black market in other states, in violation of both federal and state law.

News reports since legalization have also raised questions about potential contaminants in

recreational and medical marijuana.

This audit focused on whether the state has adequate controls in place to prevent the diversion

of legal marijuana to the black market and to oversee marijuana laboratory testing to ensure the

accuracy of test results.

Oregon Secretary of State | Report 2019-04 | January 2019 | Page 2

Though marijuana remains federally illegal, many states have moved to allow

it as federal enforcement policy has varied

Since 1970, the Federal Controlled Substances Act has placed marijuana, along with heroin and

LSD, in Schedule 1, the most restrictive of five categories of substances deemed to have a high

potential for dependency and no medicinal value. As a result of this classification, federally

approved research into marijuana has been highly limited, though a few states have pursued

research into marijuana’s therapeutic effects.

Despite federal prohibition, as of November 2018, 33 states and the District of Columbia have

approved comprehensive medical marijuana programs, and 10 states and the District of

Columbia have legalized small amounts of marijuana for adult recreational use.

Figure 1: Many states have legalized medical or recreational marijuana

As states have moved toward marijuana legalization, presidential administrations have taken

different positions on enforcement of the federal ban. Under the Obama administration,

enforcement policy shifted from the tough stance held by most prior administrations.

In 2013, a

year after Washington and Colorado legalized recreational marijuana, the United States Deputy

Attorney General issued a memorandum to federal prosecutors curtailing federal marijuana

enforcement. Known as the Cole Memo, it also outlined regulatory guidance for states with legal

markets.

The Cole Memo de-prioritized federal enforcement of the federal marijuana prohibition in states

where it was legal, provided those states instituted a rigorous regulatory system to protect

public health and safety and uphold federal enforcement priorities. A key enforcement priority

For more information on medical marijuana legalization among states, see “State Medical Marijuana Laws.” National Conference of

State Legislatures, November 8, 2018. Accessed at: http://www.ncsl.org/research/health/state-medical-marijuana-laws.aspx#2

While the executive branch has not challenged state-level laws that violate federal drug laws, the branch can influence and impact

the federal enforcement of marijuana regulations.

Oregon Secretary of State | Report 2019-04 | January 2019 | Page 3

included “preventing the diversion of marijuana from states

where it is legal under state law in some form to other

states.”

In 2018, United States Attorney General Jeff Sessions

rescinded the Cole Memo, reaffirming the federal

government’s prosecutorial discretion. This action removed

federal guidance for an acceptable state regulatory structure,

resulting in uncertainty for the future of federal enforcement.

Oregon’s history of marijuana legalization has affected the state’s evolving

regulatory framework

Oregon has long been on the leading edge of marijuana legalization among states. In 1973,

Oregon became the first state to decriminalize minor marijuana possession, lowering penalties

to those comparable to a traffic ticket. Oregon’s law followed a federal commission’s

recommendation that Congress legalize small amounts of marijuana, a proposal rejected by the

Nixon administration.

In 1998, voters approved a ballot measure that legalized marijuana for

medical purposes. Despite additional legislative changes that focused on developing Oregon’s

medical marijuana program, state controls for preventing leakage from the medical market into

the black market remained relatively limited. Voters approved the legalization of recreational

marijuana in 2014.

Early medical marijuana legislation only legalized patient use and access

In 1998, Oregon joined a handful of states in legalizing medical marijuana when voters approved

Measure 67. The measure allowed patients with qualifying medical conditions to obtain a

medical marijuana card that allows them to grow, possess, and use limited amounts of

marijuana. The new law created a registry for patients and their designated primary caregivers

who could assist them in accessing medical marijuana.

Subsequently, OMMP, which administers the patient registry, was created within the Public

Health Division of OHA. In 2005, the Oregon Legislature mandated a state registry for marijuana

grow sites, permitting patients to obtain marijuana from an assigned grower. Beyond the

registry, the law did not implement regulatory controls for preventing medical marijuana

leakage into the black market.

To curb black market activity, lawmakers legalized medical dispensaries and introduced

controls under OHA

Following legalization of medical marijuana, the number of medical cardholders grew steadily

while patient and grower limits were expanded. Since 2006, registered patients can legally

possess up to 24 ounces, or 1.5 pounds, of marijuana, and registered grow sites can produce

multiple pounds, an increase above amounts initially allowed. At the same time, the medical

grow sites remained unregulated; OMMP would not have authority to conduct grow site

inspections until 2016.

Media reports alleged high levels of diversion out of state from the medical market from 2010 to

2012. One news report claimed that law enforcement agencies identified over a dozen

operations illegally exporting hundreds of pounds of medical marijuana to at least seven states.

By 2013, illegal dispensaries existed across the state, according to a legislative summary for

President Nixon appointed the 1972 National Commission on Marihuana and Drug Abuse, which recommended amending federal

law to decriminalize marijuana possession, use, and low-level retail.

Diversion as defined by the

Cole Memo

A key federal enforcement

priority identified by the memo

included: “Preventing the

diversion of marijuana from states

where it is legal under state law in

some form to other states.”

Oregon Secretary of State | Report 2019-04 | January 2019 | Page 4

House Bill 3460. Concerns also arose among

patients about their ability to access safe and

reliably sourced marijuana.

In 2013, the state Legislature passed House Bill

3460 legalizing medical marijuana dispensaries

and establishing a new registry program. This

added a new regulatory component to OHA’s role

in medical marijuana, which had previously

focused more on health. The law introduced

regulatory controls to the medical market:

dispensary registrants were required to install

security systems, participate in product testing,

and submit to inspections. The law also gave the

agency authority to inspect dispensaries. A

compliance unit tasked with conducting those

inspections was later formed in 2015.

Recreational marijuana legalization required more robust regulatory oversight

In 2014, Oregon voters approved Measure 91 to legalize the production, sale, and use of

recreational marijuana. In a 2017 letter to the United States Attorney General, Governor Kate

Brown affirmed that Oregon’s regulatory framework for the state-sanctioned marketplace met

the Cole Memo’s standards for preventing diversion and promoting public safety and health.

The Governor highlighted several controls the state had implemented for tracking marijuana,

such as security systems for facilities, grow limits, and a “robust testing regime.” These controls,

as well as the state agencies responsible for their implementation, are authorized in state law.

The law defines Oregon’s entire regulatory structure, including provisions for preventing out–of-

state diversion and requiring testing.

OLCC was tasked with overseeing and implementing preventative controls for the recreational

marijuana market, while OMMP retained responsibility for the medical side. Since then,

numerous legislative changes have increased both OLCC and OMMP’s oversight authority, but

have also posed a challenge for these regulatory agencies.

OLCC and OHA, charged with marijuana regulation, face challenges from rapid

legislative changes in an emergent and dynamic market

OLCC is responsible for regulating recreational marijuana

OLCC’s authority includes licensing, investigating, and rulemaking for the production,

processing, and sale of recreational marijuana. The agency also oversees the distribution and

sales of all distilled spirits in Oregon.

Governed by a seven-member Board of Commissioners, the agency consists of three major

operational programs: the Distilled Spirits Program, the Recreational Marijuana Program, and

the Public Safety Program. OLCC employs 304 staff with roughly 59 assigned exclusively to

marijuana licensing, enforcement, and program administration as of 2018. However, many other

OLCC employees not exclusively assigned to recreational marijuana also help manage and

support the program.

Oregon Revised Statutes Chapter 475B.

A registered indoor medical grow.

Oregon Secretary of State | Report 2019-04 | January 2019 | Page 5

Figure 2: Marijuana regulatory milestones for Oregon, 1970 – 2018

The Recreational Marijuana Program is exclusively authorized to allow recreational marijuana

sales to consumers through retail stores. The program also tracks the growing, transporting,

processing, and selling of recreational marijuana products. The Public Safety Program is

responsible for licensing and regulating both liquor and recreational marijuana in Oregon.

Senate Bill 1057, passed in 2017, resulted in the Medical Marijuana Tracking Program,

Oregon Secretary of State | Report 2019-04 | January 2019 | Page 6

responsible for administering tracking and inspections of

medical marijuana dispensaries, processors and certain

growers as discussed further below.

As of October 2018, OLCC had a total of 2,038 active licenses,

made up of retailers, producers (growers), processors,

wholesalers, and testing laboratories. Growers make up the largest group, at 1,094 active

licenses.

Figure 3: Definitions for OLCC marijuana license types

License type

Definition

Producer Also known as a grower; may grow marijuana outdoors, indoors, or both.

Processor

A business that transforms the raw marijuana into another product (topicals, edibles,

concentrates, or extracts).

Wholesaler A business that buys in bulk and sells to licensees rather than to consumers.

Retailer A business that sells directly to consumers.

Laboratory

A lab that tests marijuana based on rules established by OHA and is accredited by the

Oregon Environmental Laboratory Accreditation program (ORELAP). All labs licensed in

Oregon are private sector businesses.

OLCC collects approximately $1.4 billion in revenue per biennium, with 95% resulting from

distribution of distilled spirits. After accounting for agency expenditures, inventory purchases,

and liquor agent compensation, about $327 million of alcohol revenue is remitted to the state

General Fund, while approximately $229 million is allocated to cities and counties.

Figure 4: The bulk of OLCC’s active licenses are for growers, otherwise known as producers

Note: Numbers current as of October 2018.

Source: OLCC.

OLCC’s recreational marijuana program is solely funded by fees and fines paid by marijuana

licensees. For the 2017-19 biennium, the agency expects to collect about $19 million in licensing

fees. The agency also receives up to $1.25 million in marijuana tax revenue per quarter to cover

196

1,094

591

133

200

400

600

800

1,000

1,200

Laboratory Processor Producer (grower) Retailer Wholesaler

# of active OLCC licenses

OLCC Licensing Fees

For the 2017-19 biennium, the

agency expects to collect about

$19 million in licensing fees.

Oregon Secretary of State | Report 2019-04 | January 2019 | Page 7

tracking and inspection costs for some medical growers. Apart from licensing fees, no agency

revenue is dedicated to marijuana licensing or compliance efforts.

OHA oversees Oregon’s medical marijuana program and testing

OMMP registers and regulates medical marijuana patients, caregivers, dispensaries, processors,

growers, and grow sites. OMMP’s Compliance unit works to ensure compliance with statutory

and administrative requirements for program participants by conducting site visits and

investigating complaints. As of December 2018, the compliance program included four

permanent Compliance Specialist positions and four limited duration staff positions. The

program also administers the Oregon Medical Marijuana Online System, a database for reporting

and tracking the production and transfer of medical marijuana products, as well as a database

for recording registrants.

As of October 2018, OMMP had a total of 65,805 registrants and 13,959 registered grow sites.

Figure 5: Patients still make up the largest group of OMMP active registered cardholders

Note: Numbers current as of October 2018.

Source: OHA.

OMMP is housed within OHA’s Public Health Division, Center for Health Protection, which has a

biennial budget of $5.5 million, a very small percentage of the $17 billion OHA budget. OMMP is

funded through a combination of General Fund dollars ($250,000 per biennium for

administering the Oregon Cannabis Commission) and card registration fees. Declining

enrollment directly impacts funding. Fiscal Year 2018 actual and projected net revenues were

about $12.4 million, but costs are projected to exceed revenues in Fiscal Year 2019. The program

is expected to operate at a $4.6 million deficit in Fiscal Year 2019, of which roughly $3.6 million

is due to legislation directing OMMP funds to support other public health programs.

In addition to managing OMMP, OHA also promulgates marijuana

testing rules, setting requirements for testing, labeling, and

dosage of all recreational and medical marijuana products.

Another OHA program, Oregon’s Environmental Lab

Accreditation Program (ORELAP), accredits qualified marijuana

laboratories for testing marijuana. ORELAP’s main work consists

of accrediting over 150 environmental laboratories in Oregon, other states, and several

countries, with drinking water safety considered a main priority. ORELAP receives funding from

the EPA to perform accreditations of drinking water labs. Marijuana labs pay a fee to undergo a

biannual assessment as part of the accreditation process. No additional federal or state funding

has been made available to assess and audit marijuana labs. The program includes just five staff,

34,892

14,313

16,600

13,959

5,000

10,000

15,000

20,000

25,000

30,000

35,000

40,000

Patient Caregiver Grower Growsite

# of active OMMP registrants

OMMP deficit

OMMP is expected to operate

at a $4.6 million deficit in

Fiscal Year 2019.

Oregon Secretary of State | Report 2019-04 | January 2019 | Page 8

which devote part of their time to marijuana accreditation. While ORELAP accredits labs, OLCC is

responsible for licensing labs for marijuana testing. Labs must be accredited for specific

marijuana tests in order to obtain an OLCC license.

OHA and OLCC also work with the Oregon Department of Agriculture on issues related to the use

of pesticides. Both agencies can make referrals to the Oregon Department of Agriculture when

test results reveal the potential use of illegal pesticides by medical and recreational growers.

The Department of Revenue manages marijuana sales tax collections and distributions

The recreational marijuana system in Oregon is expected to generate over $540 million in sales

in 2018. Recreational marijuana sales are subject to a 17% tax, administered and collected by

the Oregon Department of Revenue. Cities and counties can also vote to place an additional local

sales tax of up to 3% on recreational marijuana. From January 2016 to November 2018, the

Department of Revenue collected approximately $207 million in state tax revenue from retail

sales. By law, all state marijuana tax revenue is distributed using the following formula:

• 40% to the State School Fund;

• 20% to the Mental Health, Alcoholism, and Drug Services Account;

• 20% to cities and counties;

• 15% to Oregon State Police; and

• 5% to OHA, for drug treatment and prevention.

When the recreational marijuana program first started, OLCC loaned $1.5 million in funding

from its liquor program to help cover startup costs until enough license fees were received to

fund the program. That loan was paid back from state marijuana tax revenues, meaning the first

of those tax revenues collected went for that purpose. This requirement contributed to a delay in

the distribution of funds to schools and the other groups required under the law until 2017.

The Department of Revenue requires licensed retail shops to file marijuana tax returns every

quarter. Retailers are also required to make monthly deposits of the taxes they have collected.

According to the Department of Revenue, about 60% of deposits are made in cash.

Other than the small amount of ongoing tax revenue that goes to OLCC to cover the cost of

including some medical growers in its Metrc tracking system, no marijuana tax revenue is

dedicated to recreational marijuana compliance or licensing.

Since recreational marijuana was legalized, OLCC and OMMP have faced frequent

legislative changes and a rapidly expanding recreational retail market

Between 2015 and 2018, the Legislature passed numerous bills expanding the oversight

authority and responsibilities of OLCC and OMMP, and modifying the requirements for market

participants that both agencies regulate. For both agencies, implementation of many of these

bills required extensive rulemaking, creation of policies and procedures, substantial technology

changes, and a variety of related tasks. Changes in the law also imposed tight deadlines,

providing little time for implementation.

Oregon Secretary of State | Report 2019-04 | January 2019 | Page 9

Figure 6: Recent legislative changes and agency implementation milestones, 2014 – 2018

Following recreational marijuana legalization in 2014, the Legislature allowed medical

dispensaries to sell limited amounts of marijuana and marijuana products to recreational

customers until OLCC had developed its recreational licensing system. Per OMMP, this early

retail sales period, which lasted from October 2015 through December 2016, incentivized profit-

seeking businesses to register, increasing medical dispensary and processor registrations until

OLCC began issuing recreational licenses. In an assessment released in May 2018, OMMP

reported that their compliance program was not sufficiently staffed to review the influx of

dispensary and processor applications, and address compliance issues.

Since OLCC began issuing recreational licenses in 2016, the number of all types of active OLCC

licensees has trended upward, with growers increasing most significantly as shown in Figure 7.

In October 2018, there were a total of 1,094 active OLCC grower licensees, up almost 400% from

274 in October 2016.

Oregon Secretary of State | Report 2019-04 | January 2019 | Page 10

Figure 7: Since OLCC began issuing licenses in 2016, the number of active processor, producer, retailer and

wholesaler licenses has trended upward

Source: OLCC.

OLCC implemented “seed to sale” tracking for both markets

Statute requires that all recreational marijuana legally produced in Oregon be tracked. OLCC

uses Metrc, a proprietary “seed to sale” system that captures data showing the entire “chain of

custody” of a marijuana plant from when it was still a seed through the final retail sale to

consumers. This virtual tracking, combined with identification tags on the marijuana itself,

camera coverage of licensed facilities, and OLCC inspections to verify inventory levels, is

intended to help prevent diversion by accounting for marijuana at all stages of production.

Starting in July 2018, tracking in Metrc was extended to all medical dispensaries and processors,

as well as all medical grow sites growing for three or more patients. OLCC’s Medical Marijuana

Tracking Program now has authority to administer the tracking and to perform compliance

inspections of these medical grow sites, though OHA retains the authority to address violations.

OLCC and Governor Brown have characterized this medical marijuana tracking in Metrc as an

important step for preventing diversion from the medical market.

Oregon’s persistent black market heightens the importance of preventive

controls

According to law enforcement and news reports, black market marijuana prices in states

without a legal recreational market are several times higher than prices in Oregon’s legal

market, creating compelling profit incentives for the diversion of both illegally grown marijuana

and marijuana from Oregon’s legal recreational and medical systems. Oregon’s total marijuana

production is unknown and difficult to determine, largely due to black market production and

the state’s still emergent tracking of the legal market. The legality of homegrown marijuana

further complicates production estimates. However, the industry has flourished, with the

volume produced estimated to significantly exceed local consumption.

The Oregon-Idaho High Intensity Drug Trafficking Area (HIDTA) program

released a report

August 2018 providing rough estimates of marijuana production and consumption in Oregon,

The Oregon-Idaho High Intensity Drug Trafficking Area (HIDTA) program, established by the White House Office of National Drug

Control Policy (ONDCP), consists of 14 counties and the Warm Springs Indian Reservation. The program is committed to facilitating

collaborative drug control efforts among law enforcement agencies and community-based organizations and reducing the impact of

illegal trafficking and use of drugs throughout Oregon and Idaho.

“An Initial Assessment of Cannabis Production, Distribution, and Consumption in Oregon 2018 – An Insight Report.” Oregon-Idaho

HIDTA, August 16, 2018. Accessed at http://oridhidta.org/cannabis-production-distribution-consumption-assessment/

Oct 2016, 274

Oct 2018, 1,094

200

400

600

800

1,000

1,200

# of active OLCC licenses

Processor Producer (grower) Retailer Wholesaler

Oregon Secretary of State | Report 2019-04 | January 2019 | Page 11

based on an analysis of data from OLCC, law enforcement, and

other indicators. The study estimated that Oregon can produce

between 440,000 and 911,500 kilograms of marijuana annually

— up to roughly two million pounds. Consumers in the state are

estimated to use between 84,000 and 169,000 kilograms a year.

However, these consumption estimates are based on surveys of

marijuana users, so actual use among Oregon residents could be

considerably higher or lower.

Additionally, a decline in marijuana prices in Oregon has made profitability challenging for some

growers and retailers. Per OLCC,

the substantive number of licensed retailers have driven down

prices, as evidenced by a significant decline in average price per gram for usable marijuana

(marijuana flower) — from $9.73 in October 2016 to $4.62 in June 2018. Low prices make it

challenging for some licensed growers to earn a profit on the marijuana they have grown, which

could cause some growers to try to recoup their profits by selling their marijuana in other states

where marijuana is still illegal and prices are higher.

OLCC has already had experience with diversion to the black market. In September 2018, the

agency revoked a recreational grower’s license in response to 13 compliance violations, which

included misrepresenting marijuana information in the state’s tracking system. Two of the

licensee’s plants reported as destroyed were found at a residence where a butane explosion had

occurred earlier in the year, linking the grower to black market activity. OLCC suspended the

license of a processor, as well, after its investigation of potential license violations and the arrest

of a managing member of the business in November 2017 for attempting to deliver marijuana in

Nebraska.

HIDTA reports that between July 2015 and January 2018, approximately $48 million worth of

marijuana believed by law enforcement to have possibly originated in Oregon was apprehended

in 37 states. In August 2018, six individuals not licensed by OLCC were charged for their parts in

two large interstate conspiracies to traffic marijuana grown in Portland to three other states.

Another black market problem relates to the unlawful and unregulated marijuana extraction

performed at unlicensed processing facilities, which endangers public safety. Butane, an

inexpensive and flammable solvent, can be used to extract THC from marijuana plants to make

hash oil.

In improperly ventilated areas, the solvent easily ignites. The Oregon State Police’s

Drug Enforcement Section has witnessed a dramatic increase in the number of clandestine

butane hash oil labs. From July 2015 through January 2018, law enforcement discovered 64

unlicensed marijuana extraction labs, and during the same period, the Legacy Oregon Burn

Center treated 71 victims of burns from butane hash oil. According to news reports, one 2017

explosion destroyed two homes in Portland and caused two deaths.

Marijuana testing is critical for protecting public health and consumer

interests

Marijuana and its products can become contaminated and must be tested to protect public

health. Current state testing requirements are intended to ensure products for sale are

reasonably safe and have accurate potency levels. However, as state regulations for marijuana

OLCC 2019-2021 Agency Request Budget, accessed at

https://www.oregon.gov/olcc/docs/Budget/Legislative_Budget_19_21/2_Agency_Summary.pdf

Butane hash oil is a concentrated form of marijuana involving a process that uses butane to extract THC and other cannabinoids

from marijuana leaves and flowers. For more information, see “What is butane hash oil or BHO? Definition of popular marijuana

terms.” Oregonian, May 12, 2014. Accessed at

https://www.oregonlive.com/marijuana/index.ssf/2014/05/butane_hash_oil_glossary_of_te.html

Marijuana production

estimate

Oregon-Idaho HIDTA

estimates that Oregon can

produce between 440,000

and 911,500 kilograms of

marijuana annually.

Oregon Secretary of State | Report 2019-04 | January 2019 | Page 12

testing have developed in Oregon, independent investigations by Portland newspaper The

Oregonian found persistent contamination in marketed marijuana products.

Marijuana cultivation and processing methods make it susceptible to contamination

Marijuana grows operate on a wide spectrum of sophistication. Some grows are tightly

controlled in technologically advanced indoor facilities; plants are grown in climate controlled

chambers where every aspect of the plant’s cultivation is monitored. Other grows are

comparatively “low-tech,” often set outdoors and dependent on seasonal cycles.

After harvest, marijuana is dried and divided into batches. Batches are then divided up and may

be sold as flower or processed into edibles and other derived products before being sold in retail

shops all over the state. Processing often involves the use of solvents to extract or concentrate

the active ingredients from marijuana.

Marijuana cultivation, both indoor and outdoor, is associated with a variety of pests, bacteria,

and fungi. Growers have used a wide variety of pesticides to ward off insect infestation. Pesticide

misuse poses serious health risks to consumers. Exposure may cause a host of symptoms, such

as difficulty breathing, abdominal pain,

vomiting, dizziness, and muscle cramps;

some pesticides are potentially carcinogenic.

Marijuana and its products can also be

contaminated with microbiological

contaminants,

such as mold or salmonella,

potentially hazardous growth enhancers,

and even heavy metals such as chromium

and lead. While marijuana in any form is

prone to contamination, extracts and

concentrates may present a greater risk as

any contaminants will become concentrated

during processing.

To protect consumers against exposure to pesticides, solvents, and other contaminants,

marijuana and marijuana products are tested to ensure they are reasonably safe for

consumption.

Batches are tested for THC and CBD potency and screened for specific contaminants. This testing

may happen at different points along the seed-to-sale route; raw flower may be tested shortly

after being dried, and processed batches are tested after the extract or concentrate has been

made. All marijuana products must be tested prior to being transferred to retail facilities.

Inaccurate testing prefaces OHA’s expanding responsibilities

An investigation in 2015 by The Oregonian claimed to identify a number of potentially harmful

pesticides in marijuana products that had cleared mandated testing and were being sold at

medical dispensaries.

The newspaper reported that independent labs they commissioned to

perform blind testing found 14 pesticides on 10 marijuana extracts. Most of the pesticides were

considered potential carcinogens and either exceeded the state’s permitted levels or were

excluded from pesticide regulation. A separate investigation by The Oregonian earlier that year

also claimed to discover discrepancies between the THC levels advertised on the labels of

Microbiological contamination is the introduction of microbes, such as bacteria, fungi, viruses, and other toxins to products.

“A tainted high.” Oregonian, June 11, 2015, accessed at https://www.oregonlive.com/marijuana-legalization/pesticides/#

Climate controlled grow chambers used by a large indoor

facility.

Oregon Secretary of State | Report 2019-04 | January 2019 | Page 13

edibles and levels found in lab re-testing.

While testing allows for a margin of error, some of

the labeled potency results were substantially higher or lower than advertised.

The discovery came only a couple of years after the legalization of medical dispensaries, when

the Legislature first introduced requirements for marijuana testing, specifically for mold,

mildew, and pesticides in products sold in medical marijuana dispensaries. At this time, only a

few legitimate marijuana testing companies existed in Oregon. Apart from the limited state

testing requirements for the marijuana products sold at medical dispensaries, lab procedures

and practices for marijuana testing remained largely unregulated. In addition, the news media

reported that a “cottage industry” of marijuana testing had emerged across the state and nation.

In the wake of recreational marijuana legalization, the Legislature expanded OHA’s role to set

testing requirements for all medical and recreational marijuana sold in Oregon. OHA convened a

workgroup in 2015 to make recommendations for specific marijuana testing and tolerance

levels. Because marijuana is federally illegal, there are no pesticides that have been explicitly

approved for use by the U.S. Environmental Protection Agency (EPA), which means that

recommendations are needed at the state level. Many of the pesticides used in Oregon are

known to be unsafe for human consumption above a certain threshold.

The workgroup created a list of high-risk pesticides and solvents known to be used during

marijuana cultivation and processing. Action levels

for these chemicals were set for marijuana

testing labs based on the smallest amount of particulate that labs could be expected to detect

with their equipment. All but two of the high-risk pesticides are illegal to use on marijuana. The

following year, in the lead up to implementing statewide marijuana testing requirements, the

Oregon Department of Agriculture created a guide list of pesticides that are not illegal for

Oregon’s marijuana growers to use.

Starting on October 1, 2016, all marijuana sold through retail shops and dispensaries was

required to pass a panel of compliance tests that included potency and pesticides. As of that date,

only two labs had been accredited, though 17 more were accredited by December 2016.

Despite additional controls, a 2017 media investigation of marijuana products sold by Portland

retail stores claimed to have found unacceptable levels of pesticide contamination in three out of

10 sampled extracts. The resulting article stated that all the extracts had previously passed state

mandated testing.

Testing requirements now cover both recreational and medical marijuana for sale

All marijuana and derived products for sale in Oregon are now required to be tested for potency

and a range of contaminants to protect public health. The purpose of state-mandated testing is to

ensure product on retail and medical dispensary shelves is safe and states accurate potency

levels. Currently, OHA testing requirements include THC and CBD potency, 59 pesticides

considered high risk, 24 solvents potentially used during

processing, and moisture content and water activity

levels. Water Activity tests typically measure the partial

vapor pressure of water in a substance and are used to

assess the risk for microbial growth. OHA and OLCC can

also order random testing for microbiological

“How potent are marijuana edibles? Lab tests yield surprising results.” Oregonian, June 4, 2015, accessed at

https://www.oregonlive.com/marijuana/index.ssf/2015/03/how_potent_are_marijuana_edibl.html

The established action level marks tests as having failed (for pesticides and solvents) and should trigger a response from OLCC or

OHA once they have been alerted of the failed test result.

“Testing marijuana for pesticides: How we did it.” Oregonian, June 7, 2017, accessed at

https://www.oregonlive.com/marijuana/index.ssf/2017/06/testing_marijuana_for_pesticid.html

Oregon marijuana labs

In Oregon, 22 labs were accredited

and licensed to perform marijuana

compliance testing as of October 2018.

Oregon Secretary of State | Report 2019-04 | January 2019 | Page 14

contaminants, such as E. coli and salmonella, and heavy metals like lead and arsenic, though

those tests are not currently required.

In Oregon, 22 labs were accredited and licensed to perform marijuana compliance testing as of

October 2018. These labs, like other licensees, are private sector businesses and work directly

with growers, processors, and other licensees that are licensed by OLCC or registered with

OMMP. Labs perform every step of testing, including collecting and processing samples,

performing compliance tests, and reporting those results to their clients.

All test results for recreational marijuana are required to be tracked in Metrc and reported to

OLCC, and all marijuana in the recreational system must be tested.

Testing in the medical marijuana program is comparatively limited. Medical product that enters

the commerce stream through the small number of remaining medical dispensaries and

processors must be tested

, and failed test results are required to be reported to OHA. However,

usable marijuana transferred directly to patients from growers is not required to be tested.

When pesticides and solvents are detected above the action level by a marijuana testing lab, the

test is counted as a failure. Tests that fail for solvents can be remediated; the extract or

concentrate batch will be reprocessed to remove the solvent, then retested. However, in most

cases, batches of usable marijuana that fail for pesticides

cannot be remediated, though retests can be performed to

verify the results. The Oregon Department of Agriculture

is alerted after a pesticide testing failure and may perform

an investigation of the originating grower. Marijuana

batches with pesticide contamination must usually be

destroyed by the grower if remediation is not possible.

All items for sale from a retailer or medical dispensary

must include documentation of passing test results.

Medical growers serving patients, patients growing for

themselves, and home growers among the general

population are generally exempt from testing

requirements. They may cultivate and use product that

has not undergone any compliance testing.

Medical growers using Metrc that choose to have their product tested are required to have those test results entered into Metrc.

Why do we test for THC and CBD?

THC (tetrahydrocannabinol) is the

principal psychoactive constituent in

marijuana. This is the component

that produces a ‘high’ and may affect

motor skills and other cognitive

functions in users.

CBD (cannabidiol) is a compound

considered by many to have a range

of medicinal benefits. It is not

intoxicating and may prevent seizures

and nausea, and provide pain relief.

Oregon Secretary of State | Report 2019-04 | January 2019 | Page 15

Objective, Scope, and Methodology

Objective

This audit had two objectives. The first was to determine whether Oregon has adequate controls

in place to deter diversion of marijuana from the recreational and medical systems to the black

market. Our second objective was to determine whether the State is adequately overseeing

marijuana testing to ensure test results are accurate.

Scope

This audit focused on controls related to marijuana diversion and laboratory testing in OLCC’s

recreational marijuana program and OMMP managed by OHA, as well as marijuana laboratory

accreditation policies and procedures in ORELAP, which is also part of OHA.

Methodology

To address our objectives, we used a methodology that included, but was not limited to:

conducting interviews, analyzing marijuana tracking and laboratory testing data, and reviewing

documentation.

We conducted interviews with OLCC’s executive director, other directors and managers, policy

and data analysts, licensing staff, and inspectors. We also met with managers, inspectors, and

assessors with OMMP and ORELAP.

To learn about the views, opinions, and perspectives of stakeholders, we met with managers or

staff from the Oregon Department of Agriculture, Oregon Association of Counties, the Governor’s

Office, the City of Portland, the chair of the Oregon Cannabis Commission, and other

stakeholders. We also met with attorneys and officers from law enforcement agencies, including

the United States Attorney for the Oregon District, Oregon State Police, Oregon-Idaho High

Intensity Drug Trafficking Areas program, and several local law enforcement agencies around

the state. Additionally, we met with industry representatives and advocacy groups, such as the

Oregon Cannabis Association, Compassionate Oregon, and some OLCC license holders.

To gain an understanding of internal controls for diversion and laboratory testing, we reviewed

state laws and administrative rules, as well as policies and procedures, inspection checklists, and

other control documentation from OLCC, OMMP, and ORELAP. Additionally, we observed some

OLCC and OMMP compliance inspections, and observed an accreditation assessment at a

marijuana laboratory with an ORELAP assessor. To look for indications of diversion or problems

with laboratory testing, we requested and analyzed marijuana tracking data stored in OLCC’s

data tracking system, Metrc, for the period of January 2017 to July 2018. We concluded that

Metrc data on adjustments were not reliable enough for our purposes, based on our audit

objectives, as errors in the data make it difficult to use in aggregate to identify diversion. We

have made recommendations that address these data errors. While the Metrc data on marijuana

lab testing included some outliers, we concluded it was reliable enough for our purposes, based

on our audit objectives.

To gain an understanding of practices in other states, we interviewed and surveyed state

officials and reviewed supporting documentation from the following states: Washington,

California, Colorado, Nevada, Michigan, Maryland, and Rhode Island.

We conducted this performance audit in accordance with generally accepted government

auditing standards. Those standards require that we plan and perform the audit to obtain

sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions

Oregon Secretary of State | Report 2019-04 | January 2019 | Page 16

based on our audit objectives. We believe that the evidence obtained provides a reasonable basis

for our findings and conclusions based on our audit objectives.

We sincerely appreciate the courtesies and cooperation extended by officials and employees of

OLCC and OHA during the course of this audit.

Oregon Secretary of State | Report 2019-04 | January 2019 | Page 17

Audit Results

OLCC has made progress implementing a regulatory structure for recreational marijuana, but

data errors and a lack of inspections hamper the agency’s ability to deter diversion. With no

authority to cap licenses and only a short period to establish rules and begin licensing, the

agency was overwhelmed by rapid market growth and unable to gradually increase staff,

licenses, and inspections to the levels required for adequate oversight.

In contrast to OLCC, OMMP has only a minimal regulatory structure in place, which greatly

increases the risk of diversion. The program lacks the authority to require medical growers to

implement more controls, has few inspectors, and is hindered by dropping fee revenues and

high turnover among inspectors. By addressing their regulatory gaps, OLCC and OMMP could

forestall additional federal scrutiny and benefit public health and safety in Oregon.

Oregon’s marijuana testing regime has evolved since the advent of legal recreational marijuana.

Current testing requirements address some public health risks, but do not address others, like

those that can be caused by heavy metals and some microbiological contaminants. While all

retail marijuana must pass compliance testing, there is no mechanism in place for verifying the

accuracy of test results produced by private labs. Both OHA and OLCC have the authority to

conduct random testing to confirm test results, but no action has yet been taken to perform such

testing.

Oregon’s lab accreditation program can do more to ensure that labs meet and maintain

accreditation standards to safeguard public health. Not all active labs are fully accredited for the

full spectrum of testing responsibility, and when issues arise that threatens a lab’s accreditation

status, ORELAP struggles to respond quickly and effectively.

Though OLCC has made progress developing its recreational marijuana

regulatory program, weaknesses exist that could increase the risk of diversion

While OLCC has implemented security, surveillance camera, and marijuana tracking

requirements, accuracy errors in the tracking data make it difficult to use in aggregate to identify

potential compliance problems or diversion. After marijuana businesses are licensed, proactive

compliance and harvest inspections are used to verify that licensees’ inventories match what

they have entered into the tracking system. However, only 3% of retailers and 32% of growers

have received a proactive inspection or harvest inspection, respectively, though OLCC reports

that inspectors visited most licensees in 2018.

Since marijuana licensing began in 2016, OLCC has received many more license applications

than forecasted. As a result, staffing and inspections have lagged. OLCC’s data system also

contains few controls to prevent errors, and the agency has not set inspection goals or reviewed

inspector workloads to determine if they have enough inspectors.

OLCC has made progress establishing a regulatory framework for recreational marijuana

Since Measure 91 passed, OLCC has been developing the rules governing how recreational

marijuana is produced and sold in Oregon. However, because only Washington and Colorado had

legalized recreational marijuana before Oregon, OLCC had few examples on which to model its

regulatory program and no established best practices to follow.

Many of the rules and controls OLCC has put in place help reduce the risk that recreational

marijuana licensees will divert marijuana to the black market, either in Oregon or in other states.

There are three key regulatory components to help prevent diversion: surveillance cameras,

seed-to-sale tracking, and compliance inspections. When agency staff or inspectors observe

Oregon Secretary of State | Report 2019-04 | January 2019 | Page 18

anomalies in a licensee’s tracking data, they can inspect the licensee’s property and inventory,

and use surveillance camera footage to observe what was happening at the licensee’s facility

when the anomalies occurred. In this way, these components all work together to deter

diversion by licensees.

Surveillance cameras and security systems. Like other states with legal recreational

marijuana, OLCC requires all licensed businesses to have properly functioning security

equipment in place, including:

• surveillance cameras that cover all entrances and rooms;

• battery backup capable of powering surveillance cameras for at least an hour;

• storage capacity for at least 90 days of camera footage, kept in a separate room with

limited access;

• actively monitored alarm systems, with sensors on all exterior doors and windows; and

• commercial grade doors and locks.

OLCC inspectors conduct pre-license inspections to ensure that license applicants meet all

security and surveillance camera requirements — as well as many other requirements — before

they can begin operating as licensed OLCC businesses.

Seed-to-sale tracking system. OLCC uses Metrc to track all marijuana in the recreational

system from its beginning as a seed or immature plant to the point when it is sold in a licensed

retail shop. Colorado, Nevada, and Maryland, among other states, also require their licensees to

track their marijuana products using Metrc. This tracking system allows OLCC to see the origin

and destination of all marijuana in the recreational system. Gaps or anomalies in a licensee’s

tracking data could indicate product that has been diverted out of the regulated system.

Starting in July 2018, OLCC began sending out automated email warnings to licensees when

information they entered into Metrc appears to indicate a violation of certain OLCC rules, such as

selling more product to an individual than is allowed under the law. These email warnings are

sent once a day and include any and all potential rule violations that have been flagged by the

system. As of October 2018, OLCC had also hired additional data analysts to help review and

make sense of the large volume of data contained in Metrc. These staff are working on creating

data “dashboards” for each regional office that highlight licensees whose Metrc data appears to

contain a relatively higher number of potential violations. These dashboards are being designed

to give regional compliance managers a quick snapshot of these licensees so inspectors can

prioritize them for follow-up visits or inspections.

Compliance inspections. Inspectors recently began conducting proactive compliance

inspections of some licensees. Also known simply as proactive inspections, they are performed

at facilities that already have a license, to determine whether the licensee is still in compliance

with OLCC rules. Facilities are proactively chosen for inspection based on their Metrc tracking

data. Compliance inspections are similar to pre-license inspections in that they verify facilities

have all required security equipment in place and that these systems are still in working order.

However, in a proactive inspection, inspectors also review a sample of a licensee’s inventory to

ensure that marijuana plants and products on hand match what the licensee has entered into the

Metrc system. Compliance inspections were a prominent regulatory feature in other states we

spoke with.

We observed five proactive inspections of retail shops. Inspectors followed prepared inspection

checklists to see that security systems, surveillance cameras, and battery backup systems were

functioning properly. They also reconciled a sample of marijuana products against licensees’

inventories in Metrc, reviewed product labels, and checked that all products had correct Metrc

ID tags. Each of the inspections we observed had some deficiencies identified, including

discrepancies between Metrc tracking data and product on hand.

Oregon Secretary of State | Report 2019-04 | January 2019 | Page 19

Because the risk of diversion increases during harvesting, OLCC has also begun conducting

harvest inspections during the outdoor harvest season, typically September and October each

year. When outdoor growers are ready to harvest, OLCC requires them to notify the agency

through Metrc. Those notifications are routed to a regional compliance manager, who then

assigns inspectors to conduct unannounced inspections at a portion of the growers that are

harvesting. Other than their timing, the agency describes these inspections as similar to

proactive inspections. However, according to OLCC, harvest inspections provide the best “bang

for the buck,” as inspectors are able to conduct many inspections over a short period of time, all

at a point in the process when the risk of diversion and other compliance violations are high.

For 2018, OLCC conducted 354 harvest inspections across the state, equal to 32% of all 1,094

licensed growers and 56% of the 628 outdoor and mixed outdoor-indoor growers as of October

2018. About three-fourths were in compliance with all rules, and roughly a quarter had at least

one deficiency, though some had potential violations that could result in license cancellation.

Figure 8: While most licensed growers that received a harvest inspection were in compliance with all OLCC

rules, a small percentage had violations that could lead to license cancellation

Source: OLCC.

In addition to proactive and harvest inspections, OLCC inspectors are also in contact with

licensees for other types of compliance work. For example, inspectors also perform minor decoy

operations to help ensure retail shops are not selling to minors, alteration inspections when a

licensee makes a change to a licensed facility, compliance investigations, and pre-license

inspections.

Data errors and a lack of performance benchmarks reduce OLCC’s ability to use the Metrc

tracking system to help prevent diversion

According to OLCC, the Metrc system tracks marijuana in the legal recreational system and

points out red flags and risks in a licensee’s compliance with marijuana regulations. Those red

flags and risks could be the result of user mistakes, or they could stem from potential

compliance violations, which could range from a minor omissions or misunderstanding of the

rules to major violations that result in license revocation. OLCC data analysts can run queries of

the Metrc data to pull out those errors for further examination. However, data inconsistencies

make it extremely difficult to differentiate errors or mistakes from potential compliance

violations when reviewing the data in aggregate.

For example, we reviewed 12 months of data on adjustments of marijuana packages

tracked in

the Metrc system. Adjustments can be made to account for changes in weight due to waste,

spoilage, moisture loss, entry error, or various other factors. Because adjustments, like all other

data in Metrc, are self-reported by licensees, adjustments are a key way in which a licensee could

attempt to falsify their data. The Metrc data we reviewed included 37,550 adjustment records. In

Once a marijuana plant is harvested, the harvested marijuana is separated into different “packages” that are tracked in Metrc.

Growers in

compliance with all

rules

73%

Growers with at least

one deficiency 15%

Growers with

potential violations

that could lead to

cancellation

12%

0% 100%

Oregon Secretary of State | Report 2019-04 | January 2019 | Page 20

examining the adjustment data, we found a number of obvious errors in some adjustments. For

example, a marijuana testing lab had reported having destroyed 81,273 pounds of marijuana

samples — an unlikely amount, given that a sample is generally only a few grams. We also found

other examples of adjustments that were logically inconsistent, such as packages with an

increase in weight due to waste or spoilage.

While these adjustment errors were relatively easy to identify, without examining individual

licensees’ data in Metrc, there is no way to know if other adjustments, or even the marijuana

packages themselves, are being correctly and honestly tracked in the system. Without looking in-

depth at a licensee’s data and ultimately reconciling that data back to their inventory on hand

through an inspection, it is difficult to tell whether outliers in the data are related to errors or

larger compliance issues, such as diversion.

OLCC also has not yet established baselines or other performance measures that can be used to

help identify licensees whose Metrc data differs significantly from other similar licensees.

However, the agency only has about two and a half years of Metrc data to work with, which

along with the data errors and rapid growth in the number of licensees makes it difficult to

identify baselines for how licensees’ data should look in the system. The data dashboards

mentioned previously may represent a first step in that direction.

OLCC’s marijuana tracking system contains few controls for preventing data entry errors

Data inconsistencies are due in part to the Metrc system having few automatic checks or

controls to prevent users from making data entry errors. According to the agency, Metrc just

provides “the rules of the road” for licensees, but does not put up any barriers to prevent them

from breaking those rules. However, these data errors, and the resulting adjustments that have

to be made in order to correct them, make it difficult to use the data in aggregate to identify

potential diversion. Potential data errors can require OLCC to follow up with a licensee, or may

even require a visit by inspectors in order to determine whether the licensee just has a problem

with their data or if the information in Metrc is pointing to larger compliance problems.

Another potential error source that can make it difficult to work with aggregate-level Metrc data

are third party point-of-sale systems.

These systems sometimes have problems

communicating with Metrc, causing errors that later have to be corrected. We observed

proactive inspections at five marijuana retail shops. In three of those inspections, the retailers

either mentioned encountering problems with their software communicating with Metrc or

inspectors saw discrepancies between the system and Metrc that appeared to indicate a

communication issue.

Previous audits in Oregon and Washington, as well as general guidance on data management

from the Government Accountability Office (GAO),

recommend improvements in data tracking

and benchmarking. The Audits Division’s information technology audit of OLCC released in

February 2018 noted that problems with the reliability of OLCC’s Metrc data could hinder the

agency’s ability to ensure licensees’ comply with agency rules.

An audit by the Washington

State Auditor’s Office recommended that Washington’s Liquor and Cannabis Board create

reasonable data ranges, or benchmarks, to help identify higher risk transactions.

GAO’s

Internal Control Guide affirms the importance of accurate data that can be used for tracking and

Point-of-sales systems help merchants record product sales and track their inventory.

The GAO is an independent, nonpartisan agency within the legislative branch of the federal government that examines how tax

dollars are spent and provides objective, reliable information to help government work more efficiently. It also establishes standards

for federal and state auditors around internal controls, financial audits, and other types of government audits.

“Cannabis Information Systems Properly Functioning but Monitoring and Security Enhancements are Needed,” Oregon Secretary

of State: February 2018, https://sos.oregon.gov/audits/documents/2018-07.pdf

“Improving Cannabis Risk Management Tools Using Business Transaction Data.” Office of the Washington State Auditor: August

2018, accessed at http://www.sao.wa.gov/state/Documents/PA_LCB_Improving_Cannabis_Risk_Management_ar1022033.pdf

Oregon Secretary of State | Report 2019-04 | January 2019 | Page 21

monitoring. It recommends that data entry features in government systems be designed in a way

that supports data accuracy, and that incorrect data be identified, investigated, and quickly

corrected. As noted previously, OLCC also has not yet established benchmarks that can be used

to help identify licensees with unusual Metrc data when compared to their peers.

Lack of inspections weakens OLCC efforts to prevent diversion

Because the Metrc system relies on licensees self-reporting their marijuana products and

transfers, inspections are essential for ensuring that inventories and transfers of marijuana

products are consistently and correctly tracked in Metrc. OLCC staff have noted that inspections

are a key enforcement component to help push licensees to remain compliant with the agency’s

tracking requirements.

Though all licensed businesses are inspected prior to receiving a license, OLCC has lagged in

performing proactive inspections once those businesses have opened. OLCC began conducting

proactive inspections in June 2018. As of October 2018, the agency had only completed 16

proactive inspections of licensed retail shops, amounting to

roughly 3% of the 591 licensed retail shops. OLCC managers are

not certain of the total number of retail shops that have been

inspected because those inspections have not been tracked

consistently. However, they believe a new case management

system that rolled out in late 2018 will help with inspection

tracking. Additionally, OLCC has not conducted proactive

inspections of other licensees, including 196 processors, 133

wholesalers, or 24 labs.

Growers likely represent Oregon’s largest diversion risk among

all licensees, given that they are most negatively impacted by

the drop in marijuana prices. However, only 354 licensed

growers have ever received harvest inspections — just 32% of

all 1,094 licensed growers. Furthermore, no indoor growers have had a harvest or proactive

inspection. By comparison, other states we contacted conduct regular inspections of all

marijuana businesses. For example, Nevada inspects all recreational marijuana licensees

annually, and Maryland conducts quarterly inspections of all medical marijuana licensees.

Counting all contacts inspectors had with licensees, OLCC reports having visited roughly 1,290

licensees in 2018, though there is some uncertainty around that number, as contacts with

licensees were not consistently tracked until late 2018. The agency also reports having

conducted about 400 pre-license inspections in 2018.

OLCC generally has fewer inspectors than other states with recreational marijuana and has

not analyzed inspection staffing needs

OLCC may not have enough inspectors to conduct regular proactive inspections, which could

affect its ability to deter diversion on the part of licensees.

As of October 2018, OLCC had 23 inspector positions for roughly 2,038 licensees, a ratio of about

one inspector for every 88 licensees. Additionally, despite the agency imposing a moratorium on

new applications in June 2018, there are still roughly 1,400 pending applications that are ready

for pre-license inspections, adding to inspectors’ workloads. The agency plans to ask the

Legislature for authority to hire eight additional inspectors, to decrease the expected ratio of

inspectors to licensees to about one inspector for every 75 licensees, but they do not plan to do

so until the next legislative session in February 2019.

OLCC has conducted proactive

inspections at just 3% of

licensed retailers

Of the 591 licensed marijuana

retailers, only 16 had received a

proactive inspection as of

October 2018, or 3%. OLCC

managers are not certain of the

total number of retailers that

have been inspected because

those inspections have not

been tracked consistently.

Oregon Secretary of State | Report 2019-04 | January 2019 | Page 22

Other states have lower ratios of inspectors to licensees, which allows them to inspect licensees

on a regular basis. In Maryland’s medical marijuana program, the ratio is 1:8, with all licensees

receiving quarterly inspections, though the state has comparatively few licensees.

Rhode

Island inspects licensees twice a year and has an inspector to licensee ratio of 1:11, while

Nevada inspects all licensees at least annually and had a ratio of 1:48 as of September 2018.

The GAO’s Internal Control Guide also provides guidance on determining program staffing levels.

The guide recommends identifying program objectives that include measurable criteria,

assessing performance measures over time, and ensuring adequate staffing.

OLCC managers have indicated a desire to conduct annual inspections of all licensees, as well as

annual minor decoy operations at all licensed retail shops to ensure these shops are not selling

marijuana to minors. However, that goal has not been formalized. An inspector to licensee ratio

of 1:75 could potentially allow OLCC to adequately inspect and monitor its licensees on an

annual basis. However, the agency has not analyzed inspector responsibilities and workloads to

determine how many inspections each inspector can complete in a year. Without a set goal for

how frequently they plan to inspect licensees and an analysis of inspector workloads, agency

managers cannot know if they have enough staff to meet that target. OLCC needs to set

inspection goals and analyze workloads to determine whether current staffing levels will allow

the agency to achieve its desired outcomes.

Depending on the results of OLCC’s analysis, the agency could re-assess recreational marijuana

licensing fees if additional revenues are needed to continue building the regulatory structure.

State marijuana licensing fee structures can be complex and consist of differing elements making

direct comparisons challenging. However, OLCC’s fees are lower than in some other states, as

shown in Figure 9.

Figure 9: Oregon’s marijuana licensing fee is low compared to some other states

State

Overall range of

licensing fees for all

types of marijuana

businesses

Retailer license tiered? New retailer license fee

Annual

retailer

license

renewal fee

Oregon $1,000 to $5,750 No $4,750 $4,750

Nevada $10,000 to $30,000 No $20,000 $6,600

California* $135 to $200,000

Four tiers based on

estimated maximum

dollar value of planned

operation

Ranges from $4,000 to

$120,000 depending on

Tier

Same as

initial

licensing fee

Washington $250 to $1,480 No $1,480 $1,480

Note: *California licensing fees include both medical and recreational licenses.

Source: State-provided data to audit questionnaire; California data was collected from their website, accessed at

https://cannabis.ca.gov/faqs/

With a short timeframe to implement a program and no cap on the number of licenses,

OLCC initially lacked resources to perform inspections and other core regulatory functions

After the Legislature implemented Measure 91, OLCC had just six months to write all the

temporary rules needed to implement the legislation. At the same time, the agency had to

borrow both staff and funding from the liquor program to start standing up a regulatory

As of August 2018, Maryland had 14 medical growers (capped at 22 licenses), 14 medical processors (also capped at 22 licenses),

and 65 medical dispensaries (capped at 102 licenses).

Oregon Secretary of State | Report 2019-04 | January 2019 | Page 23

structure for recreational marijuana. At the time, OLCC had not received any funding for the

program and had not yet received enough licensing fees to cover the program’s start-up costs.

One factor that complicated the rollout of the recreational marijuana program is that OLCC did

not have the authority to limit the number of licensees or number of plants a licensed grower

can have. Other legal states, such as Washington and Nevada, have either limited the number of

licenses allowed or capped the number of plants some licensees can grow. Although OLCC tried

to forecast the number of license applications they expected to get, the agency could not limit

those applications in order to allow for a smooth and gradual increase in staffing and

implementation of licensing and inspections.

Prior to accepting license applications, the agency forecast that it would license approximately

826 marijuana businesses through the end of the 2015-17 biennium, based on the number of

licenses Colorado and Washington issued during the first year of their programs. In actuality,

they ended up issuing 1,308 licenses by July 2017, or 58% more than forecast for that period.

This resulted in an immediate strain on the program’s ability to comprehensively issue licenses,

conduct proactive inspections, and implement other critical elements of the regulatory

framework. Overall, the agency had received more than twice as many license applications as

they expected to as of December 2017, and that number grew to 4,389 by October 2018, as

shown in Figure 10. This volume has required inspectors to conduct more pre-license

inspections and prevented them from conducting more follow-up compliance inspections.

Due to workload concerns, the agency put a moratorium on processing any new license

applications received after June 15, 2018. OLCC has continued to struggle with processing a high

volume of renewal applications while introducing certain OMMP grow sites to Metrc starting in

July 2018. These OMMP grow sites also require inspections.

Figure 10: Number of total OLCC applications exceeded initial estimate and has trended upward since 2016

Source: OLCC.

Oct 2018, 4,389

500

1,000

1,500

2,000

2,500

3,000

3,500

4,000

4,500

# of OLCC license applications received

Total OLCC license applications

In June 2018,

OLCC stops

processing new

applications

OLCC initially

estimated 800 to

1,300 applicants

Oregon Secretary of State | Report 2019-04 | January 2019 | Page 24

Structural weaknesses within OMMP greatly increase the risk of diversion in

Oregon’s medical marijuana program

Only a minimal medical marijuana program regulatory structure has been put in place by OMMP,

due in part to statutory limitations. Growers are not required to have security systems or

surveillance cameras because the program lacks the authority to mandate them. By statute, less

than 10% of medical grow sites are required to track marijuana plants and transfers of product

to patients in Metrc, and reporting requirements for other medical grow sites are limited. From

January 2017 to September 2018, only 2.9% of medical grow sites received an inspection, due to

a combination of decreasing fee revenues, an apparent lack of inspector positions, and personnel

issues, including high turnover among inspectors. OMMP also has not set inspection goals or

targets for how many inspections should be completed each month.

In contrast to OLCC licensing requirements, OMMP registration requirements for medical

marijuana growers are limited

While OLCC is developing a structure for regulating the recreational marijuana system, the

medical marijuana program overseen by OHA has few rules or controls in place to prevent

diversion to the black market. OHA published an assessment of OMMP in May 2018 that pointed

out a number of the program’s weaknesses, including poor data tracking and lack of inspections.

Moreover, as shown in Figure 11, the program lacks several other controls required by OLCC

and other states.

Figure 11: OMMP lacks many of the grow site registration requirements OLCC has implemented

Registration Requirements

OLCC

Recreational Marijuana

OMMP

Medical Marijuana

Criminal background checks Required for all licensees

Required for all grow site

administrators

Pre-Registration inspections Required for all licensees Not required

Surveillance camera systems with

battery backup

Required for all licensees Not required

Security systems with active

monitoring

Required for all licensees Not required

Seed-to-sale tracking system Required for all licensees Only required for some grow sites

Source: OLCC and OHA.

OMMP does not conduct any inspections before a medical grower is registered and does not

require growers to have surveillance cameras with battery backups or either actively monitored

security systems or security guards.

Limited tracking of medical marijuana heightens diversion risks

Unlike OLCC licensees, most registered medical marijuana growers are not required to track

their plant totals or transfers to patients in Metrc. Of the 13,959 registered grow sites as of

October 2018, about 6,230 were smaller home or personal medical grow sites legally exempt

from any tracking. Of the remaining 7,729 grow sites, only 879 were required to report in Metrc,

Not required for licensees that have authorized personnel on site at all times.

Oregon Secretary of State | Report 2019-04 | January 2019 | Page 25

or about 11%. There may be additional grow sites that should be tracking in Metrc that are not

because the vast majority of them have not been inspected.

In April 2018, OMMP initially identified roughly 2,301 grow sites that needed to begin tracking

in Metrc and began an outreach campaign to notify them, including sending letters to each of

them. As of July 2018, that number had dropped to 1,320 grow sites, as 800 grow sites reported

dropping the number of patients they grow for (which would require a drop in the number of

marijuana plants they have on hand) and 181 reportedly left the program. However, OMMP has

only conducted inspections of 44 of these grow sites, so the program cannot confirm that they

have actually dropped patients or are no longer growing. Of the remaining 1,320 grow sites, 670

had registered in Metrc as of July 2018, while 280 were exempted from tracking because they

had applied to convert to an OLCC licensee and 365 were out of compliance with the law. As of

December 2018, OMMP had moved to revoke the registrations of 211 of these grow sites.

Medical growers and grow sites who do not track in Metrc, but who grow for patients other than

themselves, are required by statute to submit monthly reports to OMMP.

According to the

program, there were 6,850 of these grow sites in October 2018.

However, OMMP notes that only

about 40% actually submit monthly reports as required. These reports must include mature and

immature plant counts, amounts of usable marijuana on hand, and any marijuana transferred to

patients. Without these reports, OMMP does not know how much marijuana these growers are

producing. Additionally, because this information is only reported once a month and is not

tracked from seed to sale, as it would be in Metrc, there is a greater risk of diversion.

Several other states with medical marijuana systems, like Maryland, Nevada, and Michigan,

require licensed medical marijuana growers to track plants and product using Metrc or another

seed-to-sale tracking system.

Similar to recreational marijuana, regular inspections of medical marijuana are needed to

ensure compliance and prevent diversion

OMMP has a team of compliance inspectors that began in 2015 with a mandate to inspect

medical dispensaries, and later processors. As dispensaries and processors moved over to the

recreational system, the compliance unit shifted its focus in fall

2016 to inspections of medical grow sites, though it still also

inspects the few remaining medical dispensaries and

processors. The unit began with seven compliance inspectors,

but had just six as of December 2018.

From January 2017 to September 2018, OMMP compliance

inspectors inspected 201 of the 6,850 registered grow sites

required to submit monthly reports (though they also inspected

173 medical dispensaries and 26 processors over that time).

This amounts to just 2.9% of these medical grow sites receiving

an inspection over that period.

OMMP is hindered by limited regulatory authority, a sharp decrease in fee revenues, a lack

of inspectors, and challenges with performance management

Oregon statutes prevent OMMP from requiring medical growers to implement many of the

controls OLCC requires of its licensed growers. For example, Oregon law expressly prohibits the

agency from requiring medical grow sites to have any sort of security system, including

Oregon Revised Statutes, Chapter 475B, Section 816.

Some of these states may not require caregivers who grow for patients or patients who grow for themselves to track marijuana

plants and products from seed to sale.

From January 2017 to

September 2018, OMMP

inspected just 2.9% of grow

sites required to submit

monthly reports. During that

time, inspectors conducted

inspections at just 201 of the

6,850 medical grow sites

required to submit monthly

reports.

Oregon Secretary of State | Report 2019-04 | January 2019 | Page 26

surveillance cameras, alarm sensors, or physical barriers.

Similarly, data reporting

requirements for medical growers are set by statute, restricting OMMP’s ability to require

additional medical growers to report data in the Metrc system or to push growers to provide

more comprehensive reporting in its Oregon Medical Marijuana Online System.

comparison, some other states we surveyed, such as Maryland, Rhode Island, and Nevada,

require their licensed medical marijuana establishments to have security systems, surveillance

cameras, and to track marijuana plants and products using a seed-to-sale tracking system like

Metrc.

The fee revenues that fund OMMP come from registered dispensaries, processors, growers, and

patients. A decrease in all types of registrants since 2015 and 2016 has caused significant

reductions in fee revenues. Nearing the end of the early recreational sales period (October 2015

through December 2016), active OMMP medical dispensary registrations began to drop

dramatically as OLCC started licensing retailers in late 2016.

Figure 13: Active OMMP dispensary registrations dropped dramatically as OLCC started licensing retailers in

October 2016

Source: OMMP.

Active dispensary registrations dropped from a peak of 427 in October 2016 to 16 in February

2018, as dispensaries converted to retail marijuana stores that sell to both recreational

customers and medical cardholders. A similar trend occurred for OMMP registered processors,

with medical processing sites peaking at 142 in December 2016, then falling dramatically as

OLCC began licensing processors. Other OMMP registrants have also decreased since 2015, as

shown in Figure 14.

Oregon Revised Statutes, Chapter 475B, Section 828.

Oregon Revised Statutes, Chapter 475B, Section 816.

Oct 2016, 427

Feb 2018, 16

100

150

200

250

300

350

400

450

# of dispensaries

Active medical dispensaries

In October

2016, OLCC

starts

licensing

recreational

retailers

Oregon Secretary of State | Report 2019-04 | January 2019 | Page 27

Figure 14: Since 2015, the number of active OMMP patients, caregivers, growers and grow sites has trended

downward

Source: OMMP.

OMMP is unsure of the reasons for the significant decline in these registered cardholders, though

some have obtained OLCC licenses and moved to the recreational market. Moreover, OMMP

patient registry cards enable patients to purchase medical marijuana tax-free from any licensed

retail shop or dispensary, but require patients to pay a $200 annual fee. Depending on how

much they purchase, the tax savings for some consumers may not make up for the cost of this

fee, which could partially account for the drop in OMMP registered patients and their associated

caregivers. OMMP plans to send a survey to prior and current OMMP registered patients in early

2019 with some questions aimed at gauging why many have let their registration lapse.

As of October 2018, only five OMMP medical dispensaries and three processing sites were

registered in Oregon. Registered patients and growers have dropped by more than 50% since

October 2015. As noted previously, this has led to a large decrease in fee revenue. In addition,

some of the fee revenue OMMP collects has been reallocated to other programs within OHA. The

program reports that in the 2015-2017 biennium, the Legislature reallocated $18 million to fund

other public health programs. In the current 2017-2019 biennium, another $7.1 million has been

reallocated to fund state support for public health programs. As OHA also reported, OMMP could

not increase fees to make up for both the loss of fee revenues and reallocations, forcing the

program to cut all positions in its compliance unit, though some positions were later restored.

Despite the cuts in its funding, OMMP is still responsible for overseeing the medical marijuana

program, including conducting compliance inspections of registered grow sites. However, the

program has just four permanent inspector positions, with another two limited duration

inspector positions that expire in June 2019 (along with the compliance unit manager’s position,

which expires at the same time). In total, the unit has just six inspector positions to cover 6,850

grow sites who grow for patients other than themselves, an inspector-to-grow site ratio of

1:1,142. As OMMP notes in its assessment, this number of positions cannot adequately enforce

compliance or provide a significant deterrent effect, which greatly increases the risk of medical

growers diverting marijuana to the black market.

Oct 2015, 78,045

Oct 2018, 34,892

10,000

20,000

30,000

40,000

50,000

60,000

70,000

80,000

# of active OMMP registrants

Patient Caregiver Grower Growsite

Oregon Secretary of State | Report 2019-04 | January 2019 | Page 28

High turnover has affected the compliance unit’s staffing, as

well. As of December 2018, the unit had just three of its six

inspector positions filled due to resignations and job rotations.

In each year since 2015, at least two inspectors have either

resigned or taken job rotation positions in other agencies.

Inspectors we spoke with cited a perceived lack of support for

the program within OHA, low morale, and a lack of effective

internal management as key factors driving turnover. As an

example, staff noted that the unit spent several months in both

2017 and 2018 revising inspection procedures for medical processors and dispensaries, even

though very few of those registrants remain. Staff also noted that inspectors must manually

transfer data between databases when performing investigations because the program was

unable to retain support staff to perform this administrative function.

Additionally, like OLCC, OMMP has not set any goals for inspection frequency and has no targets

for how many inspections should be completed each month. The program reports that it would

need five regionally-based teams of three to five inspectors in order to adequately ensure

compliance among medical grow sites.

Addressing regulatory gaps at both OLCC and OMMP would reduce the risk of

diversion and federal action, and better protect public health and safety

In addition to possibly heightening the risk of federal action against Oregon marijuana

businesses, diversion of marijuana to the black market could potentially affect public health and

safety. Diverted legal marijuana provides additional marijuana supply for criminal operations

and illegal processors, and could potentially allow unsafe, untested marijuana into Oregon’s

black market, where it could make its way into the hands of minors.

As noted previously, OLCC is in the process of developing its regulatory framework, and still

needs more accurate Metrc data, established baselines and timeframes, and enough inspectors

to ensure licensees are regularly inspected. OMMP has only a minimal regulatory framework in

place in the medical marijuana system, with limited security requirements, data tracking, and

inspections. Without improvements in these areas, both agencies face an increased risk that

compliance violations, potentially including diversion, could go undetected.

Addressing these regulatory weaknesses would demonstrate that Oregon is serious about

preventing and reducing diversion and is taking steps to improve the regulatory environment

around legal marijuana. On the other hand, not addressing the regulatory vulnerabilities in the

recreational and medical marijuana systems could contribute to increased skepticism from

federal authorities about the sincerity of Oregon’s efforts to effectively regulate marijuana. This

could lead to increased federal scrutiny of marijuana businesses in the state.

Black market activity and diversion in Oregon could theoretically diminish tax revenue if

substantial amounts of product are diverted elsewhere. Diversion could also increase public

safety risks. Putting more controls in place to help prevent diversion could potentially allow law

enforcement to focus more resources on purely black market marijuana operators, which often

engage in other criminal activity. Black market operators, including illegal processors linked to

several explosions, would also be deprived of a possible source of marijuana. This could prevent

untested, unsafe marijuana from entering Oregon’s black market, where it could potentially fall

into the hands of underage marijuana users.

OMMP Compliance Staffing

The OMMP compliance unit has

just six inspector positions to

cover 6,850 grow sites who

grow for patients other than

themselves, an inspector-to-

grower ratio of 1:1,141.

Oregon Secretary of State | Report 2019-04 | January 2019 | Page 29

Oregon’s marijuana compliance testing requirements fail to address some

important public health concerns

Compliance testing is critical to ensuring that marijuana in Oregon is free of harmful

contaminants and is safe for consumption. Oregon’s current compliance testing regime and

reporting requirements have contributed to the declining presence of pesticides above

acceptable levels in recreational marijuana. However, Oregon does not require testing for heavy

metals or specific microbiological contaminants. Medical marijuana is also largely exempt from

testing requirements, despite serving patients who may be more vulnerable to contamination

than the general population.

State enforcement efforts and improved cultivation methods contribute to the declining

presence of pesticides in compliance tests

The declining rate of pesticide testing failures in an industry that continues to grow indicates

that compliance testing can be an effective tool for protecting consumer health. Compliance

testing in Oregon has shown that pesticides are present in the state’s supply of recreational

marijuana. Pesticides are the most common and most serious reason for testing failures, and are

frequently used during marijuana cultivation. However, the number of tested packages with

pesticide presence above the acceptable level decreased from 5.6% in January 2017 (104 out of

1,857 packages failed) to 2.1% in July 2018 (60 out of 2,835 packages failed). Most types of

marijuana product showed lower rates of pesticide contamination in the first half of 2018 than

in 2017.

Figure 15: The 10 most common pesticide failures among Oregon marijuana

Pesticide

Failed tests

(above action level)

Total tests

(presence detected)

Percentage of

tests failed

Bifenazate 100 180 56%

Malathion

100 147 68%

Chlorpyrifos

110 199 55%

Spiromesifen

141 224 63%

Spinosad

162 271 60%

Chlorfenapyr

176 297 59%

Bifenthrin 191 279 68%

Myclobutanil

225 333 68%

Pyrethrins

310 550 56%

Piperonyl butoxide

479 1,288 37%

Note: All of the 59 high-risk pesticides the state requires testing for, and 15 of the 24 solvents, showed up in compliance tests between

January 2017 and July 2018. Some pesticides showed up in hundreds of tests, occasionally in amounts that greatly surpassed established

action levels, though others were only present in a handful of tests and are of less concern.

Source: OLCC.

OLCC and OHA refer growers with pesticide failures to the Oregon Department of Agriculture,

which works with growers to take steps to comply with state law. The department takes an

educational approach to most initial violations, requiring that growers participate in a

compliance assistance program. Growers who continue to fail pesticide testing may have to pay

fines up to $10,000 and risk losing their OLCC license. From October 2016 to June 2018, 143

recreational growers and 122 medical growers were referred to the Oregon Department of

Agriculture for failed pesticide tests. OLCC made 12 more referrals from July through September

for 11 different kinds of high-risk pesticides. Approximately 75% of recreational growers and

processors in Oregon had no documented pesticide test failures between January 2017 and July

2018.

Oregon Secretary of State | Report 2019-04 | January 2019 | Page 30

Figure 16: Rates of pesticide detection vary, but both the number and rate of failed pesticide tests has

dropped over time

Note: This chart excludes pesticide testing data from Evio Labs Medford. While the overall presence has not notably declined, pesticides

are showing up in marijuana in increasingly small amounts.

Source: OLCC.

Lab staff we spoke with expressed concern about the continuing presence of pesticides in

Oregon marijuana, as well as concerns around questionable lab practices that may lead to

contaminated product passing compliance tests and reaching the market. However, greater

general awareness of the effects of pesticide use among growers and evolving cultivation

methods have likely contributed to a decline in the presence of pesticides above acceptable

levels in compliance tests. Some licensees told us that cultivation methods have shifted in recent

years as some growers adopt more sophisticated growing techniques and were better able to

time the pesticide application to reduce potential contamination.

Even low levels of certain pesticides could be unsafe, particularly for frequent or heavy users.

While pesticide contamination continues to be an area of concern for recreational marijuana

products, testing and agency efforts to educate growers help to reduce the associated public

health risk. When pesticides are detected, it increasingly tends to be in minimal amounts. The

impact on consumer health, and whether or not there is one, is not known.

Heavy metal and specific microbiological testing are not required in Oregon even though

these contaminants could pose a risk to consumers

Contaminants including heavy metals such as chromium and microbiological contaminants such

as salmonella may pose a risk to consumers. Tests for these are not required in Oregon, though

other states include them in their compliance testing panels.

The risks of microbiological contaminants and heavy metals being present in marijuana have

been noted in other reports.

In addition to pesticides and solvents, OHA determined in 2015

that microbiological contaminants such as E. coli and salmonella were areas of concern for

marijuana products. Marijuana is also prone to growing molds that could contain carcinogenic

Compliance panel includes required tests discussed on page 14.

In addition to the 2015 OHA Technical Report and 2016 Association of Public Health Laboratories report (both discussed in text

and referenced below), the American Herbal Pharmacopoeia identified contamination risks for marijuana. Risks were also identified

in Cannabis sativa L. – botany and biotechnology. Other states have referenced the Pharmacopoeia in their testing rules.

Upton, R., Craker, L., in ElSohly, M., Romm, A., Russo, E., Sexton, M., & American Herbal Pharmacopoeia. (2014). Cannabis

inflorescence: Cannabis spp.; standards of identity, analysis, and quality control.

McPartland, J. M. & McKeron, K. J. (2017). Contaminants of concern in cannabis: microbes, heavy metals and pesticides. In Cannabis

sativa L. - botany and biotechnology (pp. 457-474) Springer International Publishing AG.

Farrer DG. Technical report: Oregon Health Authority’s process to decide which types of contaminants to test for in cannabis.

Oregon Health Authority. 2015 December.

100

200

300

400

500

Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec Jan Feb Mar Apr May Jun Jul

2017 2018

Pesticide tests

Failed tests all tests showing presence of pesticides

Oregon Secretary of State | Report 2019-04 | January 2019 | Page 31

toxins and yeast, though Oregon’s water activity tests are considered a proxy for preventing

exposure to mold.

In 2016, the Association of Public Health Laboratories published a report for state medical

marijuana testing programs that recommended testing for heavy metals in addition to solvents,

pesticides, and microbiological contaminants.

Heavy metals may accumulate in the body; some

are carcinogenic and considered to cause a variety of diseases. Marijuana is efficient at

absorbing and storing heavy metals and other pollutants found in soil and water, which

increases the risk that that marijuana users could ingest or inhale heavy metals.

California has adopted testing requirements for recreational marijuana that include panels of

microbiological contaminants and certain heavy metals. Medical marijuana in Michigan requires

both harvest and final product screening that includes heavy metals and microbiological

contaminants in addition to pesticides and solvents.

Maryland’s medical marijuana program introduced microbiological

contaminant and heavy metals compliance tests in early 2018.

During the first several months of testing, up to 30% of the

marijuana tested failed for yeast, mold, and chromium. That failure

rate had dropped to 5% to 10% by September 2018.

As of October 2018, only two marijuana testing labs in Oregon were accredited to perform

microbiological contaminant testing, and Oregon does not accredit marijuana labs for heavy

metals. From January 2017 to July 2018, approximately 100 E. coli tests were conducted on

marijuana in Oregon — meaning that less than 0.11% of tested packages received

microbiological tests. There are no records in Metrc of marijuana testing labs performing heavy

metals tests.

While the scope of risks for consumers from microbiological contaminants and heavy metals is

not clear without further research and testing, some frequent users may be unusually vulnerable

to product with any kind of contamination.

Medical marijuana is largely excluded from testing requirements, creating potential health

risks for users

Unlike marijuana sold through the recreational market, growers in the medical market are

exempt from most testing rules and are not required to test usable marijuana product before it is

transferred to a medical patient, which could expose patients to contaminants. Medical

marijuana is typically only required to be tested when it is sold through a dispensary or

processed by a medical processor. Registered patients may be more vulnerable than

comparatively healthy adults, and the lack of pesticide testing requirements for medical grows

leaves patients at higher risk for exposure than recreational consumers. Roughly 10% of

Oregon’s medical marijuana patient community includes children under 18 years of age and

seniors over 70. The patient community also includes individuals with conditions such as cancer

and HIV that can directly compromise their immune systems.

Approximately 12% of recreational retail sales have been untaxed sales to registered medical

patients. These patients have some assurance that marijuana they purchased through a

recreational retail shop has been tested for pesticides and is reasonably safe for consumption.

However, despite decreasing enrollment in the medical program, there are still thousands of

registered medical patients likely obtaining marijuana directly from medical growers.

Association of Public Health Laboratories. Guidance for State Medical Cannabis Testing Programs, May 2016.

Oregon Secretary of State | Report 2019-04 | January 2019 | Page 32

Testing medical product may not be common outside of the small number of remaining

dispensaries and medical processors. One lab we spoke with estimated that 80% of their

compliance tests were for recreational marijuana. About 10% came from the medical program,

and the rest was a mixture of hemp growers and private home growers.

Other states require testing for contaminants, including microbial

and heavy metals, for medical marijuana. In Washington, test

requirements are more stringent for medical marijuana than they

are for recreational. While recreational and medical marijuana must

be tested for microbiological contaminants, only medical marijuana

must be tested for pesticides and heavy metals.

Medical marijuana

programs in Michigan, Rhode Island, and Maryland require testing

for pesticides, solvents, microbiological contaminants, and heavy

metals.

Improved testing coverage could help ensure that vulnerable patient populations are not

exposed to dangerous contaminants that may further jeopardize their health and undermine the

potential medicinal benefits of marijuana.

Marijuana testing requirements in Oregon emphasize protecting public health, but broader

testing coverage and more research are needed to protect consumers

The decisions OHA made for marijuana testing in 2015 factor in some of the known dangers of

pesticides and solvents, and the OHA workgroup report addresses the possibility of some forms

of microbiological contamination of marijuana product. However, the report does not include a

discussion of heavy metals and Oregon’s current testing regime leaves out sources of potential

contamination that could impact consumer health. Additionally, the Labs Technical Advisory

Washington allows patients and their designated providers to grow limited amounts of marijuana for medical use but homegrown

marijuana for recreational use and sale remains illegal.

What could exposure to contaminants mean for marijuana consumers?

Both acute and long term exposure to certain contaminants can result in a range of adverse health effects

Pesticides

Chlorpyrifos can cause the nervous system to malfunction during brief exposure and is linked to

developmental delays in children of mothers with the pesticide in their blood. Bifenthrin may be a

carcinogen and ingestion can cause headaches, vomiting, and respiratory irritation. Pyrethrins can cause

difficulty breathing, vomiting and diarrhea when inhaled, and over prolonged periods may cause tissue

damage in respiratory passages, and tremors.

Microbiological Contaminants

Salmonella, which was recommended for testing but is not specifically tested for in Oregon, can cause

serious infections in young children and people with weakened immune systems. Mycotoxins found in fungi

and aspergillus mold are nephrotoxic and carcinogenic, but mold is so common to the environment that

OHA recommended not testing for them, instead opting for a proxy water activity test. The agency also

recommended including a warning about the risk to persons with suppressed immune systems.

Heavy Metals

Chromium, detected in marijuana tests in Maryland, may be carcinogenic to humans. Lead has been found

in marijuana in tests performed in Germany and has no level of safe exposure. It can affect the nervous

system, cause kidney damage, slow brain development, and cause miscarriages. Arsenic is present in some

groundwater sources and fertilizers that could be used on marijuana. Long-term exposure to arsenic can

cause cancer and skin lesions, and acute exposure may cause vomiting, diarrhea, and even death.

Oregon Secretary of State | Report 2019-04 | January 2019 | Page 33

Committee convened by OLCC in July 2015 recommended mandatory testing for E.coli,

Salmonella, several varieties of Aspergillus mold, and heavy metals, in addition to tests currently

included on the compliance panel. Several testing recommendations from both the OHA

workgroup and the advisory committee are not included on the current compliance panel.

There are barriers to expanding Oregon’s compliance testing requirements. Testing is costly,

with a full compliance panel costing between $300 and $400 per batch. The cost of testing may

already be prohibitive for many individual growers, particularly patients that qualify for reduced

card fees. Some licensees identified testing as one of their most significant operating costs.

Introducing heavy metals and microbiological contamination tests to the current compliance

panel would likely increase the cost of testing. One lab owner estimated that an expanded

compliance panel would cost both labs and their clients about 30% more than current panels.

Another barrier is lack of research around how

marijuana interacts with contaminants. Research on

the potential interactions of pesticides with

marijuana is very limited, and there are no

established exposure thresholds for marijuana and

pesticides due to the federal ban. The lack of

previous testing and research on heavy metals

means there may not be reliable information on

whether they are present in Oregon’s supply. The

wide variety of products available also complicates

testing, as different products would likely require

setting different health risk action limits for heavy

metals. Action limits set by other states tend to apply

only to smoking marijuana, and may not be adequate

for other methods of consumption.

Marijuana testing is still evolving, and states with

legal or medical marijuana programs have different

testing requirements. Risk areas may also vary from state to state, depending on differences in

cultivation and processing methods, and preexisting environmental concerns. Risk areas may

also vary by region in Oregon, which could be a factor in researching and establishing testing

requirements. OHA may consider reviewing its current testing panel and reevaluating the risks

of consumer exposure to certain pesticides, microbiological contaminants, and heavy metals.

OLCC can better ensure product safety by taking steps to verify test results

While testing is critically important to protecting public health, pressure on labs to provide high

potency test results, coupled with test subcontracting practices, increase the risk of inaccuracies

and misreporting. By taking steps to verify test results reported by Oregon’s marijuana labs,

OLCC can better ensure products sold in the recreational marijuana market are safe for

consumption

Industry pressures may influence lab practices and affect the accuracy of reported results

The marijuana “gold rush” in Oregon has led to a swiftly growing marijuana industry and tight

competition across the market. Labs are not shielded from these industry trends, and there has

been substantial growth in testing since the expansion of marijuana testing requirements in

2016. Labs are in competition with other labs, and both OLCC and ORELAP report receiving

complaints from labs, including accusations that competitors are not following testing rules or

are manipulating potency results to retain and attract customers. Marijuana testing is a nascent

industry, and unlike other kinds of environmental lab testing there is a general lack of guidance

available to these labs; no standard methodologies are in place for testing, for example.

Marijuana sample contaminated with mold found at

retail shop. Retail staff identified the mold and

removed the product from the shelf.

Oregon Secretary of State | Report 2019-04 | January 2019 | Page 34

Potency results are posted on package labels, and retailers

report that high THC potency is highly sought after and a

strong driver of sales. With production across the state

creating a supply that may outstrip demand, there is a great

deal of pressure in the industry to produce and sell marijuana

products that are desirable, lucrative, and potent.

Several labs we spoke with expressed concerns about lab

shopping, which happens when clients jump from lab to lab

seeking desired test results. Labs also told us that it was not

unusual to lose clients to other labs. Among OLCC licensees, using the services of multiple labs is

not uncommon; 24% of growers and 43% of processors used three or more labs between

January 2017 and July 2018. During the same period, 38 growers and processors used five or

more labs, and one processor used nine separate labs. There are several possible reasons for

clients to move from one lab to another; the quality of services offered may vary, the closure of a

few labs has required clients to seek other services, and some labs have changed ownership.

However, the frequent use of multiple labs is consistent with that reported by industry members

and concerns remain that some clients are seeking out labs that will give them desired results.

Average THC potency reported by labs increased from 25% in 2017 to 28% for the first half of

2018 for all marijuana products. Though extracts and concentrates are significantly more potent

on average, most of the increase was due to increases in THC potency test results for marijuana

flower. Several factors may play into increasing product potency, including its importance in

terms of sales and the increasing sophistication of growing and processing methods. Without

appropriate controls in place to verify the accuracy of test results, there is higher risk of

manipulation of samples or potency tests to artificially increase potency results.

Other test types more closely connected to product safety, in particular pesticide testing, may

also be at risk for misreporting. Batches that fail pesticide testing are supposed to be destroyed.

This could create a substantial burden on the grower or processor who will lose that source of

revenue.

There are few reliable indicators in the testing data to determine whether sample and test result

manipulation is occurring. If a package has more than one test result entry in Metrc, it could

indicate an attempt to alter the original test result, though it is also possible that it is a retest, or

that the original entry was a mistake.

According to lab staff and ORELAP lab assessors, there are numerous ways to intentionally or

unintentionally manipulate test results at multiple points along the testing process, including:

• Sample collection: While samples should be representative of the batch from which

they are taken, lab technicians who fail to follow appropriate sampling procedures could

collect product that is not representative, and potentially more or less potent, than the

rest of the batch.

• Sample preparation: When samples are prepared for analysis, they are often heated to

remove excess moisture. Heating the sample beyond a certain window of time can

artificially inflate potency results.

• Interpreting data: The lab scientist who analyzes the sample must interpret complex

sets of testing data, but labs may not have a sufficient process in place to confirm that the

analysis was sound and accurate. How the scientist interprets the output and reports the

results is up to them.

• Data tracking and sharing: While some labs have Laboratory Information Management

systems that can automatically populate test results into Metrc, others use manual entry.

As discussed in more detail on pages 40-41, labs that subcontract services also share test

Potency drives sales and may

affect testing practices

According to lab staff and others

in the industry, the pressure to

produce and sell high potency

product sometimes translates to

pressure on labs to produce high

potency results for their clients.

Oregon Secretary of State | Report 2019-04 | January 2019 | Page 35

results with each other outside of Metrc. Shared results are only reconciled with Metrc

entries on an ad hoc basis by OLCC.

Ultimately, the integrity of testing data relies heavily on the professionalism and expertise of lab

staff. The majority of workers in Oregon’s marijuana industry are required to obtain worker

permits from OLCC. In order for applicants to obtain a worker permit, a $100 fee must be paid,

they must take a test demonstrating an understanding of applicable laws and rules, provide valid

photo identification, and pass a background check. However, labs and research facilities

personnel are not required to obtain worker permits. As a result, apart from an estimate of staff

numbers, not much is known about who is employed at Oregon marijuana labs. ORELAP staff

also expressed concerns that poor lab practices and a lack of consistent testing methodologies

may contribute to potentially inaccurate test result reporting.

Verifying compliance test results can provide greater assurance of marijuana product

safety and testing accuracy

Despite having the authority to order random testing of marijuana, OLCC has not developed

procedures for random testing methods, such as shelf audits where product is removed from

retail shelves and tested, that could be used to verify the accuracy of reported test results.

Neither OLCC nor OHA

have ordered any shelf audits or other random testing to verify the

accuracy of reported test results. Verification could help ensure that product on the shelf is

reasonably safe and uncontaminated with pesticides or solvents, that the reported levels of THC

and CBD potency are reasonably accurate, and that testing lab practices are sufficient to produce

accurate test results.

As detailed earlier, shelf audits were conducted by a media organization in 2015 and 2017 and

alleged to have found several issues with marijuana being sold, even after product had passed a

required compliance panel. A similar shelf audit conducted in 2017 by a media outlet in

California purported that that 93% of the products purchased in retail shops and then submitted

for testing had unacceptably high levels of pesticide contamination.

At the time of the report,

California did not require pesticide testing. California has since introduced testing requirements

covering pesticides, solvents, heavy metals, and microbiological contaminants. Myclobutinal, a

pesticide that converts into highly toxic hydrogen cyanide gas upon combustion, was notably

present in several of the California shelf tests. Myclobutinal has also showed up in hundreds of

pesticide tests in Oregon, and above the action level in many cases.

None of the states we talked with reported conducting formal shelf audits of marijuana product,

random testing happened rarely, and only two reported conducting routine testing verification.

However, after concerns arose in Colorado about the consistency and accuracy of labs’ test

results, the state approved the development of a state-funded marijuana reference lab. The lab,

approved to open in 2019, will serve both recreational and medical marijuana programs and is

projected to be fully functional by late 2019. The lab will work with Colorado’s private labs to

verify test results, provide technical assistance, and establish analytical standards for marijuana

analysis. Colorado labs, like Oregon labs, have had to develop their own testing procedures

independent of the kind of oversight that other types of environmental labs experience.

Industry members we spoke with told us they thought testing in Oregon had become more

consistent over time. However, this cannot be confirmed as the state currently does not have a

mechanism to verify test results and has not ensured consistent practices among licensed labs.

OMMP and ORELAP have both endorsed establishing a state-funded and independently

functional reference lab that could support Oregon’s marijuana labs by providing guidance on

OHA can also order random testing of medical marijuana.

‘Pesticides and Pot: What’s California Smoking?” NBC4, February 22, 2017, accessed at

https://www.nbclosangeles.com/news/local/I-Team-Marijuana-Pot-Pesticide-California-414536763.html

Oregon Secretary of State | Report 2019-04 | January 2019 | Page 36

testing methodologies. A reference lab could also participate in random testing with state

agencies to ensure that reported test results are trustworthy and that marijuana sold in Oregon

is reasonably safe for consumption.

Subcontracting testing services between labs complicates test tracking

Subcontracting testing services complicates OLCC’s ability to track test results and hold labs

accountable for inaccuracies and misreporting. Because primary labs enter all the test results

into Metrc, the audit team was unable to verify which labs performed which specific tests when

subcontracting occurred. Test results do not tie directly to the specific lab that performed the

test. The team was also unable to identify whether there were discrepancies and outliers in the

data that could indicate misreporting or poor testing practices on the part of labs.

Oregon requires labs to be accredited for at least one type of

test in order to be licensed by OLCC, but does not require labs

to be accredited for a full compliance panel.

As of October

2018, only four of Oregon’s 22 labs were fully accredited for

all required tests. The lack of full accreditations has likely

contributed to frequent subcontracting. From January 2017 to

July 2018, 87,800 packages were tested and the results

entered into Metrc. In that time, 19 labs subcontracted testing

services on more than 11,000 of those packages. Several

hundred more packages also appeared to have been

transferred between labs for testing.

When subcontracting, the primary lab works directly with the

client, collecting samples from marijuana growers, processors,

and wholesalers. The sample is prepared and initial testing is

conducted by the primary lab. A subsample is sent to a

secondary (subcontracted) lab to complete part or all of the

full compliance panel.

The primary lab is responsible for entering all the test results

into Metrc and sending a final combined certificate of analysis

to the client. Secondary labs are not required to be notified of

results reporting by primary labs, and apart from testing

subsamples may have no interaction with licensees and no

way of confirming whether the test results they reported to

the primary lab reconcile with the results the primary lab

reported to the client.

The methods by which test results are shared between

primary and secondary labs is another concern. Labs share

certificates of analysis in different ways; some labs use

Confident Cannabis, which acts as a storage platform and

allows labs to both share and access certificates directly. Other labs share certificates via email.

Certificates are not stored in Metrc, and OLCC only makes ad hoc requests to labs for individual

certificates. The agency does not have a comprehensive record of all Oregon’s certificates of

analysis, or a mechanism for reconciling test results shared between labs with test results that

are entered into Metrc and shared with clients.

A compliance testing panel includes all tests required for a specific marijuana product. All products should receive pesticide and

potency tests, and processed marijuana should also receive a solvent test.

Figure 17: Sample sharing and

test result communication in

subcontract relationships

Oregon Secretary of State | Report 2019-04 | January 2019 | Page 37

Oregon’s testing regime can detect contaminated product before it reaches consumers. However,

neither OHA nor OLCC are able to confirm that compliance panels adequately prevent

contaminated or inaccurately tested product from reaching the point of sale. Developing a

testing verification program and an independent reference lab to assist with testing accuracy

verification would provide assurance that labs are accurately conducting and reporting test

results.

ORELAP can better safeguard public health by ensuring that marijuana testing

labs meet and maintain accreditation standards

As noted, all of Oregon’s marijuana labs have met at least some of the accreditation standards

required to perform marijuana testing. However, ORELAP lacks a strategy and capacity needed

to ensure that all marijuana labs have been fully assessed and consistently meet accreditation

standards. Several marijuana labs have been allowed to operate, despite lacking an onsite

assessment of their sampling practices. Lab failures to maintain accreditation standards have

not been addressed in a timely manner. This increases the risk that underperforming labs are

able to access and test marijuana, which could lead to contaminated product entering the market

and compromising consumer health.

Progress has been made to introduce robust lab accreditation standards to Oregon

marijuana labs

Oregon has made substantial progress toward creating a consistent marijuana testing program.

Labs that perform those services are required to obtain accreditation from ORELAP. It was noted

in some interviews with industry members that prior to 2016, marijuana testing in Oregon was

an unregulated “wild, wild west,” and that issues with inaccurate testing and unprofessional lab

practices were rampant. Interviewees also noted that the situation had improved since then,

though there continue to be some issues that have not been fully or adequately addressed.

Labs must be accredited by ORELAP for at least one test type in order to be licensed by OLCC to

test marijuana. ORELAP accredits labs under standards developed by The NELAC Institute (TNI),

known as TNI standards,

which they consider to be more stringent than standards other states

use. As of October 2018, 22 labs were accredited, though there has been considerable fluctuation

as labs have opened, closed, and consolidated with other labs.

In order to maintain their accreditations, labs must participate in a full on-site assessment with

an ORELAP assessor every two years and participate

in proficiency tests every six months. Proficiency tests

ensure that labs can produce test results within an

acceptable margin of error on a blind sample. Oregon

opened a five-year contract with Phenova in 2017, a

Colorado-based proficiency test provider. According

to Phenova, Oregon marijuana labs are becoming

more consistent over time and are producing more

routine and accurate proficiency test results than

when they started.

The conditions for proficiency tests have also become

closer to those present in compliance tests, improving

the relevancy of proficiency tests to determine

whether labs can produce trustworthy compliance

The NELAC Institute is a national accreditation program for environmental testing labs. They establish accreditation standards for

state and regional accrediting bodies.

An ORELAP Assessor observes a sampling procedure

during an on-site assessment.

Oregon Secretary of State | Report 2019-04 | January 2019 | Page 38

test results. Phenova has shifted from using “alternate” matrix proficiency tests, performed with

a proxy sample such as hops flower, to “real” matrix tests that are performed with marijuana

samples prepared by Phenova at an in-state location. Real matrix proficiency tests more closely

mimic real world testing conditions. Only solvent tests are still performed using an alternate

matrix. Solvents present a unique challenge, as they are only used during processing. There is a

wide variety of marijuana products that use processed extracts and concentrates, and preparing

and performing “real” matrix proficiency tests on each of those product types for every lab

accredited to test for solvents may not be feasible.

Competing priorities undermine ORELAP’s ability to perform timely marijuana lab

accreditations and respond decisively to potential violations

Despite overall improvements, ORELAP has struggled to fully implement marijuana lab

accreditation requirements in Oregon.

ORELAP receives federal funds through the EPA to accredit drinking water and other

environmental labs, but has not received federal or state funds for accrediting marijuana labs.

ORELAP’s scope of duties has expanded in recent years to include marijuana lab accreditations

and a variety of other environmental lab accreditations in Oregon and out of state. In addition to

marijuana, ORELAP accredits labs under the Clean Air Act, Clean Water Act, Resource

Conservation and Recovery Act, and the Safe Drinking Water Act. Based on the current fee

schedule, accreditation fees charged to marijuana labs cover the cost of the application fee, the

on-site assessment fee, but do not account for other

ORELAP responsibilities to those labs. Despite the frequent

issues that ORELAP has run into with marijuana labs,

accreditation work for those labs is not ORELAP’s only

pressing priority. ORELAP accredited laboratories must

have assessments to maintain their accreditations.

As of October 2018, ORELAP had not completed on-site

assessments of lab sampling practices for 12 of Oregon’s

22 operating marijuana labs, a critical and required

component of the accreditation process. These labs were

among several that sought accreditation in 2016 and 2017

and were granted provisional sampling accreditations. These labs submitted standard operating

procedures and other necessary documents, but ORELAP, overwhelmed with an expanding

workload and the loss of key staff, did not perform on-site assessments that included lab

sampling practices to ensure that they were following acceptable sampling procedures. Labs

with provisional sampling accreditations have been allowed to perform sampling and testing

with no limitations, with the understanding that an assessment of sampling procedures would

eventually be performed. By October 2018, only eight labs had been granted full sampling

accreditations.

Additionally, ORELAP’s response to proficiency testing failures has been slow, and has allowed

labs that may be underperforming to continue conducting crucial tests. Most of Oregon’s

accredited marijuana labs have participated in proficiency testing. When labs fail a proficiency

test, they have the option to redo the test. It is not uncommon for labs to fail a round of

proficiency tests. Pesticide proficiency in particular is a challenge, as labs must accurately

identify 59 unique pesticides within an acceptable margin of error. In August 2017, only 42% of

pesticide accredited labs passed the first round of pesticide proficiency tests. By 2018, this

amount had increased to 47%.

The majority of labs that failed initial pesticide proficiency tests in 2017 passed retests;

however, two labs that failed the initial testing round did not participate in or pass retests. In

Marijuana sampling methods

Oregon allows labs to collect either

random or representative samples of

marijuana from growers and

processors. The marijuana batch is

divided into units, and a portion of

the full sample is collected from

either at random or from each unit.

Each portion is weighed, and the

sample transported to the lab.

Oregon Secretary of State | Report 2019-04 | January 2019 | Page 39

both cases, the labs continued to perform testing for several months after failing their

proficiency tests. ORELAP eventually issued corrective action letters requiring that both labs

pass pesticide proficiency tests or risk losing their accreditations, but not before both labs had

performed numerous compliance tests for pesticides over several months for their clients.

In the first case, the lab was contacted by ORELAP four months after failing to test properly for

11 pesticides. The lab chose not to retest, but never formally withdrew their accreditation, and

ORELAP never formally revoked it. Ultimately, the lab opted to subcontract out pesticide testing

to another lab and reportedly stopped performing pesticide tests in February 2018, six months

after failing the proficiency test. They retained the pesticide accreditation, with the exception of

the 11 pesticides that failed in proficiency testing. We were unable to confirm that this lab had

stopped performing pesticide tests. Tests that are subcontracted to a secondary lab are still

tracked under the name of the primary lab in Metrc, which gives the appearance that the

primary lab conducted the test.

In the second case, the lab was not contacted by ORELAP for a full year after failing their August

2017 pesticide proficiency test. Additionally, the second lab did not participate at all in the

required tests in the spring of 2018. In the year between failing the August 2017 proficiency test

and receiving the corrective action letter, the second lab continued to operate as a subcontractor

to several other labs, receiving and presumably testing over 1,000 packages between August

2017 and July 2018. This lab was only accredited to perform pesticide tests. The lab reported to

ORELAP in September 2018 that they were taking steps to address their proficiency testing

deficiencies, but had failed to enroll in further proficiency tests as of December 2018.

Limited authority, inadequate staff coverage, and inefficient processes reduce ORELAP’s

ability to ensure Oregon marijuana labs consistently operate under accreditation

standards

ORELAP can revoke or suspend lab accreditations for

proficiency testing failures. For other types of

accreditation deficiencies, ORELAP’s authority is bound

by Oregon’s Administrative Procedures Act. Addressing

these concerns triggers a protracted administrative

process during which ORELAP is prohibited from

curtailing any of a lab’s activities until after a court

hearing. If labs choose to appeal the decision of the

court, that can delay action almost indefinitely. While

ensuring that individuals and businesses have the

benefits of due process is critically important, the state

may consider reexamining the limits of ORELAP’s

authority in egregious cases, such as sampling fraud,

which could involve a potential public health concern.

Additional oversight authority in such cases could

prevent product that should not have passed a

compliance panel from reaching retail shelves.

High workloads and inefficient, incomplete, and time-

consuming tracking processes have likely impacted

ORELAP’s ability to respond to issues arising in

Oregon’s marijuana labs in a timely manner. ORELAP

lost two key managers in early 2017 and has struggled

with low staff numbers and high workloads for the past

two years. ORELAP has five full time staff, including

three assessors, a program manager, and a program

A case of potential sampling fraud

In early 2018, ORELAP received a video

that appeared to show a lab technician

participating in sampling fraud with staff

working at a grow site. The lab

technician observed grow site staff

separate out a portion of a larger batch,

then add an unidentified powder to the

separated portion. The technician

collected the sample only from this

portion of the batch. ORELAP began an

administrative review of the lab,

scheduling a court hearing with the

assistance of the Department of Justice.

The lab appealed after the hearing but

ultimately settled with ORELAP in

October 2018. The lab’s sampling

accreditation was then suspended until

the lab could prove that improvements

had been made. The lab was active

during the full 10-month period leading

up to the suspension. As of December

28th, 2018, the lab had not completed

the required corrective action plan.

Oregon Secretary of State | Report 2019-04 | January 2019 | Page 40

support position. The program was only recently able to staff fully, and was down to three

people for over a year. They gained some position authority after taking over accreditations for

drinking water labs in California and the introduction of marijuana lab accreditations, and are

currently participating in a workload study to determine their true staffing needs.

ORELAP performs lab assessments on over 150 labs in several states and other countries. Of

these labs, 86 are outside of Oregon. A single on-site lab assessment at a large lab can take up to

100 hours of staff time and could include substantial additional travel time. ORELAP staff duties

also include answering questions from laboratories regarding regulatory requirements and

investigating and substantiating complaints. Staff reported putting in double time and being

unable to meet all their responsibilities under their current workload. One assessor said that

they were frequently on the road, and in the month of July 2018 assessed labs in Oregon,

California, and Fiji, and had to delay work related to Oregon marijuana labs in order to perform

those assessments.

ORELAP’s process for tracking and monitoring marijuana lab proficiency test data is not

efficient. The proficiency test provider is required to send copies of proficiency test results to

ORELAP when sending the results back to the labs. An ORELAP official stated that the provider

had neglected to send copies of proficiency tests conducted to the program for some time,

though how long is unclear. The provider recently began sending ORELAP the results

concurrently with the labs after being reminded that doing so was a condition in the contract.

ORELAP stores proficiency test results in individual lab folders, but they have not been compiled

into a searchable database that would aid timely tracking. As of this report writing, marijuana

proficiency test results were being copied into a spreadsheet for staff use, though that

spreadsheet was itself not yet complete. Tracking the receipt and status of lab’s proficiency test

results from the provider is time consuming and inefficient. In comparison, ORELAP has a fully

developed and searchable internal database for tracking drinking water proficiency test results

that is programmed to accept test results from outside entities and is less labor intensive for

staff.

Oregon Secretary of State | Report 2019-04 | January 2019 | Page 41

Recommendations

To help prevent diversion of marijuana from OLCC licensees to the black market, OLCC should:

1. Continue to improve data controls within Metrc, such as establishing automatic checks to

prevent entry errors before they happen;

2. Continue to develop baselines, dashboards, and other data monitoring practices, such as

setting reasonableness thresholds to help identify higher-risk marijuana transactions;

3. Establish inspection frequency goals and metrics and determine how many inspectors

are needed to meet those goals. If the current number of inspectors is too low, work with

the Legislature to identify additional funding options. Periodically reassess inspection

goals and metrics, and whether the number of inspectors aligns with them; and

4. Work with the Legislature to review its licensing fees for marijuana businesses and

consider whether licensing fees could be adjusted to support capacity building for the

marijuana regulatory program.

To help prevent diversion of marijuana from medical registrants to the black market, OHA-OMMP

should:

5. Enforce existing data reporting requirements for medical marijuana growers;

6. Establish inspection frequency goals and metrics and determine how many inspectors

are needed to meet those goals;

7. Under the guidance of the Governor’s office and the Legislature, review the level of

authority OMMP needs to improve its regulatory framework for security, product

tracking, and bolster resources for inspections, or consider placing the medical

marijuana compliance program within the existing OLCC authority and control

framework; and

8. Evaluate the reasons behind high inspection staff turnover and implement management

strategies to reduce turnover.

To help ensure the accuracy of testing results, OHA should:

9. Perform a thorough study on the potential impacts and presence of microbiological and

heavy metal contaminants in marijuana products, to make an informed decision on

adding them to testing requirements, potentially in consultation with a reference lab;

10. If microbiological and heavy metal testing are added to testing requirements, work with

testing labs and ORELAP to accredit labs for microbiological and heavy metal testing;

11. In consultation with the Legislature, review options for medical marijuana testing and

take action to better ensure product safety for medical marijuana patients. Potential

actions could include:

a. Implementing a public health campaign with assistance from other state

agencies to educate medical growers and patients on ways to avoid, reduce,

or eliminate marijuana product contamination;

b. Requiring testing for all medical marijuana to ensure it is free of

contaminants that may impact patient health;

12. Consider developing a reference lab focused on standards and methodology setting,

additional compliance testing and random testing of marijuana products, and assessing

the overall risk of marijuana product contamination; and

13. In consultation with OLCC, perform random compliance testing, or shelf audits, to

independently validate test results and assure product safety.

To help improve the accuracy of lab testing data, OLCC should:

14. Update test result tracking requirements for subcontracted tests to ensure that results

can be directly traced in Metrc to the lab that performed a specific test;

15. Require that all marijuana certificates of analysis be stored in Metrc, where they can be

reconciled with the reported lab test results

Oregon Secretary of State | Report 2019-04 | January 2019 | Page 42

16. Examine whether requiring lab staff to obtain OLCC worker permits would increase lab

accountability; and

17. Work with ORELAP and the Legislature to ensure appropriate and sufficient staff

coverage to better monitor lab practices and review test result data.

To help improve testing lab accuracy and accreditation, OHA-ORELAP should:

18. Continue transitioning alternate matrix solvent proficiency tests in Oregon to real matrix

solvent proficiency tests;

19. Complete all provisional accreditation assessments to ensure that sampling procedures

taken by labs are appropriate;

20. Streamline the proficiency test tracking process for marijuana labs;

21. Review its level of authority to address lab issues related to upholding accreditation

standards to determine what level is needed, and work with the Legislature to make

necessary adjustments;

22. Work with OLCC and the Legislature to ensure appropriate and sufficient staff coverage

to better monitor lab practices and review test result data; and

23. Develop a strategy to meet established response timelines for addressing proficiency test

failures and other lab accreditation deficiencies.

Page 2 of 7

Narrative for Recommendation 1

OLCC agrees with the high importance of data accuracy and fidelity in the Cannabis

Tracking System. The Metrc system has developed greater controls to prevent entry

errors since recreational licensure began in 2016. The OLCC agrees that more controls

can be instituted based on the nature of entry errors that have been seen to date.

OLCC will develop a list of system changes to institute additional controls to prevent

entry of impossible values (for example, lab results that exceed 1,000 milligrams per

gram). OLCC will also solicit input from Metrc users on reports and additional “checks

and balances” within Metrc that would better enable licensees to audit their own data

and confirm the accuracy of items they receive from others. OLCC will work with Metrc

to develop cost estimates and a timeline to implement the software changes in the

Cannabis Tracking System. This implementation plan is expected to be completed by

July 1, 2019.

Aside from direct data entry in the Cannabis Tracking System, licensees may enter data

via file upload (e.g. CSV files) or Application Programming Interface (“API”). API data

transmission occurs from third-party software and, although Metrc validates all

software for integration with the Cannabis Tracking System, there is much less ability to

directly influence or control the quality of data that is entered through either file upload

or the API. The OLCC will continue to work with Metrc to develop protocols to audit the

quality of data entered via file upload and/or the API on an ongoing basis.

RECOMMENDATION 2

Continue to develop baselines, dashboards, and other data monitoring practices, such

as setting reasonableness thresholds to help identify higher-risk marijuana

transactions.

Agree or Disagree with

Recommendation

Target date to complete

implementation activities

(Generally expected

within 6 months)

Name and phone number

of specific point of contact

for implementation

Agree

July 1, 2019

and ongoing

TJ Sheehy

503-872-5017

Narrative for Recommendation 2

The OLCC has begun to create a unit of compliance analysts charged with bringing the

initial vision of the tracking system to life. The Cannabis Tracking System (CTS) is at the

heart of creating a comprehensive approach of using data to create a system of violation

prevention, deterrence and detection through the automated and manual identification

of data anomalies in CTS. Central to the system is the ability to flag activities for

warnings and violation tickets followed by inspectors in the field who inspect or survey

licensee activities. Utilizing basic algorithms and programing, the regular production of

data reports will unleash the tremendous value of the data reported into CTS.

Page 3 of 7

In addition to the work already completed to warn licensees of data anomalies and

potential violations, OLCC will implement formal procedures for utilizing data from CTS

in its compliance activity. OLCC has begun to develop a compliance dashboard that

relies on data entered into CTS that is out of the expected norm. When completed this

dashboard will be utilized by compliance managers to identify high-priority cases and

licensees that may warrant greater scrutiny and follow-up. This dashboard will include

baselines of “reasonableness thresholds” and will be implemented by July 1, 2019.

RECOMMENDATION 3

Establish inspection frequency goals and metrics and determine how many inspectors

are needed to meet those goals. If the current number of inspectors is too low, work

with the legislature to identify additional funding options. Periodically reassess

inspection goals and metrics, and whether the number of inspectors aligns with them.

Agree or Disagree with

Recommendation

Target date to complete

implementation activities

(Generally expected

within 6 months)

Name and phone number

of specific point of contact

for implementation

Agree

July 1, 2019

and ongoing

Shannon Hoffeditz

503-872-5212

Narrative for Recommendation 3

It was not until 2018 with the integration of marijuana enforcement into public safety

that compliance really took hold. While there are more resources necessary to complete

this process, OLCC has established a management structure that is integrated within the

Public Safety Division and in regional field offices. OLCC has made progress on training

staff and developing field procedures for enforcement inspections of each license type.

Compliance inspections vary based on the reason for the inspection, and the level of

licensee compliance. Inspections generally fall into the following categories:

• Harvest inspections – producer licensees

• Minor Decoy Operations – retail licensees

• Compliance investigations – all licensees

• Alteration of licensed premises inspections – all licensees

• Pre-license inspections – all licensees

Currently recreational program inspectors are funded at a ratio of 100 licenses to 1

inspector. The agency believes this ratio is too low and is requesting additional staff so

the ratio will be closer to 75 to 1 in the next two years.

In OLCC’s 2019-21 budget request, the agency has asked for additional staffing including

8 marijuana regulatory specialists to ensure regulatory compliance; 1 laboratory

compliance specialist to focus on laboratory compliance, protocol and regulation; 3

Page 4 of 7

office specialists to utilize the information stored on video to enforce compliance and

prevent or detect diversion; and funding for continuing strategic and tactical

communications support related to marijuana.

In order to monitor the number of inspectors needed to effectively regulate, the OLCC

plans to utilize its case management system to help determine average inspection

times. In addition to the case management system, OLCC staff tracks the outcome of all

inspections to determine general workload based on the types of inspections being

conducted in each region and identify inspections that require significant additional staff

time, such as alleged cancellable violations.

RECOMMENDATION 4

Work with the Legislature to review its licensing fees for marijuana businesses and

consider whether licensing fees could be adjusted to support capacity building for the

marijuana regulatory program.

Agree or Disagree with

Recommendation

Target date to complete

implementation activities

(Generally expected

within 6 months)

Name and phone number

of specific point of contact

for implementation

Agree

July 1, 2019

and ongoing

Bill Schuette

503-872-5023

Narrative for Recommendation 4

The OLCC continues to work with Department of Administrative Services (DAS) and the

Legislature on appropriate funding, budget and staffing requests. Based on the budget

allocated to the agency, licensing fees are adjusted.

If license fees are to be increased, the OLCC may not do so unilaterally. While the fee

levels are established in OLCC’s administrative rules, the agency requires approval to

raise the fees and spend the revenues. OLCC’s marijuana program is exclusively fee-

funded. Fee revenues may only be at a level to cover programs costs and a small

operating reserve. If OLCC were granted budgetary authority to collect and spend more

fee revenue, the agency would only be able to fund specific positions or agency costs.

Without additional authority, OLCC could not raise fees.

The OLCC realizes this is an important conversation and will continue discussions with

the Governor and legislators as the program matures.

Page 5 of 7

RECOMMENDATION 14

Update test result tracking requirements for subcontracted tests to ensure that

results can be directly traced in Metrc to the lab that performed a specific test.

Agree or Disagree with

Recommendation

Target date to complete

implementation activities

(Generally expected

within 6 months)

Name and phone number

of specific point of contact

for implementation

Agree

July 1, 2019

and ongoing

TJ Sheehy

503-872-5017

Narrative for Recommendation 14

OLCC’s Division 25 administrative rules (OAR 845-025-5045) specify what information

labs must enter into the Cannabis Tracking System when testing marijuana items.

Divisions 7 and 64 (promulgated by OHA) specify further requirements for lab testing

and documentation. OLCC does exercise direct control over the test types from which

labs select when entering results in the Cannabis Tracking System. While the level of

effort to change these test types is minimal and would not require software

development to implement, requiring subcontracted labs to enter specific information

may require administrative rule changes and coordination between OLCC and OHA. By

July 1, 2019, OLCC will identify rule changes that may be required in Divisions 7, 25, and

64 and develop an implementation plan and timeline for any required Division 25

rulemaking to meet this recommendation.

RECOMMENDATION 15

Require that all marijuana certificates of analysis be stored in Metrc, where they can

be reconciled with the reported lab test results.

Agree or Disagree with

Recommendation

Target date to complete

implementation activities

(Generally expected

within 6 months)

Name and phone number

of specific point of contact

for implementation

Agree

July 1, 2019

and ongoing

TJ Sheehy

503-872-5017

Narrative for Recommendation 15

As in the case of implementing changes to requirements for subcontracted tests,

requiring labs to upload additional information into the Cannabis Tracking System may

require changes to administrative rules in Divisions 7, 25, and 64. Moreover, while the

functionality to require uploads of certificates of analysis has already been developed by

Metrc for a different state, if this feature were enabled in Oregon the number of files

required to be stored within the Cannabis Tracking System would have significant

implications for server capacity. By July 1, 2019, OLCC will develop an implementation

Page 6 of 7

plan that identifies required amendments to administrative rules as well as changes to

the Cannabis Tracking System and associated development or server expansion costs.

RECOMMENDATION 16

Examine whether requiring lab staff to obtain OLCC worker permits would increase

lab accountability.

Agree or Disagree with

Recommendation

Target date to complete

implementation activities

(Generally expected

within 6 months)

Name and phone number

of specific point of contact

for implementation

Agree

July 1,2019

Amanda Borup

503-872-5456

Narrative for Recommendation 16

ORS 475B.261 gives the OLCC authority to require worker permits for producers,

processors, wholesalers and retailers. The authority to regulate labs and their

employees is located in a different section of statute, ORS 475B.550, and does not

include requirements for worker permits.

By July 1, 2019 the OLCC will examine the statute, and will work with Oregon Health

Authority (OHA) and Oregon Department of Justice (DOJ) to determine if the OLCC has

the authority to issue lab worker permits. If so, OLCC will work with OHA and the

industry to determine if a worker permit for lab employees will benefit the industry and

add a level of accountability.

RECOMMENDATION 17

Work with ORELAP and the Legislature to ensure appropriate and sufficient staff

coverage to better monitor lab practices and review test result data.

Agree or Disagree with

Recommendation

Target date to complete

implementation activities

(Generally expected

within 6 months)

Name and phone number

of specific point of contact

for implementation

Agree

July 1, 2019

and ongoing

Amanda Borup

503-872-5456

Narrative for Recommendation 17

OLCC recognizes this is a critical issue for the accountability of the marijuana program in

Oregon, and will dedicate staff to work with the other agencies and the Governor’s

office to put in place a plan to strengthen regulatory oversight of the laboratory

sampling and testing. Such a plan, including a funding mechanism and potential

administrative rule adjustments, will require strong coordination between Oregon

Page 7 of 7

Health Authority (OHA), Oregon Environmental Laboratory Accreditation Program

(ORELAP), Oregon Department of Agriculture (ODA) and OLCC. The funding plan to

implement controls will require approval from the Governor and the Legislature.

In the 2019-21 OLCC budget request, OLCC requested funding for 1 laboratory

compliance specialist to focus on laboratory compliance, protocol and regulation.

Compliance staff can spend a significant amount of time researching complaints against

laboratories. Having a dedicated staff member to focus on laboratory compliance,

protocol and regulation will assist the overall efficiency of OLCC’s compliance program.

Regulatory inspectors can get needed assistance in the field and OLCC will have the

capacity to work with the OHA and ORELAP on detailed investigations and audits

(provided OHA and ORELAP are also provided resources). ORELAP will benefit in having

a contact person at the OLCC who understands laboratory protocol and the OLCC rules

and regulations. OHA will benefit by having a staff member who works directly with labs

and can track modifications of testing requirements and train and educate other

inspectors on these change.

Even with its considerable imperfections, Oregon’s aggressive testing standards are

nation leading and important to marijuana regulation across the nation and

internationally. Laboratory regulation is an important policy area for all states regulating

both medical and recreational marijuana. Protecting health and safety in this area, and

the consistency of standards between jurisdictions for measuring product qualities, is

important to harmonize. Today, testing methodology varies from laboratory to

laboratory and state to state. Regulators and the industry are looking to improve and

standardize testing to protect consumers through consistent regulation. Even though

interstate commerce is not available today, brands that consumers are familiar with are

available through each state’s regulatory systems and these products, with respect to

testing are not equivalent for consumer use. This position will help the OLCC continue to

manage to a best practices level of service.

Please contact Amanda Borup at 503-872-5456 with any questions.

Sincerely,

Steve Marks

Executive Director

Oregon Liquor Control Commission

January 25, 2019

Kip Memmott, Director

Secretary of State, Audits Division

255 Capitol St. NE, Suite 500

Salem, OR 97310

Dear Mr. Memmott:

This letter provides a written response to the Audits Division’s final draft audit report titled Oregon’s

Framework for Regulating Marijuana Should Be Strengthened to Better Mitigate Diversion Risk and

Improve Laboratory Testing.

The Oregon Health Authority appreciates the professional work of the Oregon Secretary of State’s

Office Audits Division staff as they conducted this audit of both the medical and retail marijuana

markets. We understand and appreciate the magnitude of the assignment and your commitment to

producing an accurate audit. Thank you for the opportunity to review and respond to the final draft

report. OHA agrees with the recommendations put forth and the areas for improvement and outlined

many of these areas in our report to the Oregon Cannabis Commission in May 2018. Some of the

recommendations will require legislative changes and fall outside of the scope of OHA’s current

statutory authority. This includes recommendations 6, 7, 11, 12, 21 and 22. In the absence of statute

change, the ability to comply with the recommendations is limited.

Since full legalization of marijuana in July 2015, the Oregon Medical Marijuana Program (OMMP) has

expanded its focus to include regulation of marijuana while continuing to administer the card registry

program. The program has grown to include compliance and analysis staff; developed and

implemented databases and web-based applications to track product transfers and inventory on hand

for growers, processing sites and dispensaries; enhanced all existing data systems; addressed multiple

legislative changes each year; and implemented a grow site inspection process while maintaining

inspections of dispensaries and processing sites.

The program’s two primary objectives are to remain a patient-centered registry, and to efficiently and

effectively regulate the production, transfer and testing of medical marijuana. The OMMP’s strengths

lie in timely processing of registrant cards, providing good customer service, and the design and

implementation of necessary enhancements to new and existing systems to meet new legislative

requirements. Areas for improvement include the need to improve reporting compliance and staffing

in the compliance unit. Utilizing the Cannabis Tracking System (CTS) through the Oregon Liquor Control

Commission (OLCC) has addressed reporting compliance for grow sites with three or more patients.

Additionally, having the authority to revoke growers, processors and dispensaries’ registrations for not

reporting helps bring these registrants into compliance as well. Compliance Staffing remains an area

that needs to be addressed. A robust compliance system requires a strong presence in the state, but

current staffing levels cannot sufficiently provide such a presence. The program’s management is

aware of the constraints and challenges OMMP faces.

OFFICE OF THE DIRECTOR

Kate Brown, Governor

500 Summer St NE E20

Salem OR 97301

Voice: 503-947-2340

Fax: 503-947-2341

www.Oregon.Gov/OHA

www.h

ealth.oregon.gov

SOS Audit Response

January 25, 2019

Page: 2

Additionally, regulatory stability, sufficient funding and staff resources would allow OMMP to

consistently apply requirements of the Oregon Medical Marijuana Act to better serve patients and

ensure access to medical marijuana as a therapeutic option.

The Oregon Environmental Laboratory Accreditation Program (ORELAP) was established in 1999 and

operates under ORS 438.605 to 438.620 to assess over 120 laboratories. ORELAP accredits

laboratories based upon standards established by the National Environmental Laboratory Accreditation

Program and under the guidance of the Clean Air Act, Clean Water Act, Safe Drinking Water Act, the

Resource, Conservation and Recovery Act and Oregon statute related to cannabis. Since full

legalization of marijuana, ORELAP has expanded its focus to include Cannabis testing regulation under

ORS 475B.550 to 475B.590. The program objective is to assure to the public that the accredited

laboratories meet the minimum quality standards and generate data of known quality through the

implementation of a quality assurance program that adheres to TNI Standards. ORELAP management is

aware of the current challenges and areas of improvement and is consistently working towards this

goal. Areas for improvement include the completion of provisional accreditation assessments for

sampling, continue transitioning to a more representative in matrix proficiency test sample for residual

solvent samples, to meet established response timeliness for addressing proficiency test failures and to

have established standardized methods for cannabis testing. ORELAP capacity rests mostly on current

staffing coverage to monitor lab practices and review test data. Additionally, the need for a state-

funded and independent reference laboratory could establish standardized methods for cannabis

testing which would provide guidance to ORELAP accreditation process on testing methodologies and

to ensure that reported test results are dependable and consistent between cannabis labs.

Below is our detailed response to each recommendation in the audit.

RECOMMENDATION 5

(OHA-OMMP) Enforce existing data reporting requirements for medical marijuana

growers.

Agree or Disagree with

Recommendation

Target date to complete

implementation activities

(Generally expected within

6 months)

Name and phone number

of specific point of contact

for implementation

Agree

July 25, 2019

Carole Yann

Section Manager

971-673-2507

Narrative for Recommendation 5

OMMP created a plan to address non-compliance with reporting for growers and grow sites using the

monthly Oregon Medical Marijuana Online System (OMMOS) as well as grow sites with 3 or more

patients that were required to track using the Cannabis Tracking System (CTS).

The program’s enforcement priority was to target those registrants not complying with the CTS

tracking requirements first as statute provided that OHA must revoke or not renew grow sites that did

not comply with the law by July 1, 2018. At that time. there were 365 grow sites that were out of

compliance with the law. Enforcing this tracking requirement was a time-consuming process and the

SOS Audit Response

January 25, 2019

Page: 3

program is still addressing many enforcement actions through appeals, hearing, settlement

agreements and follow-up to ensure the settlement agreements are being adhered to.

Enforcement of non-reporting for those using OMMOS will begin with warning letters sent to all

growers at grow sites who do not report for the month. They will have 15 days to report or be charged

a civil penalty. Notices of Intent to Impose Civil Penalties will be sent to those who do not comply. For

those who still do not comply OMMP will issue a Notice of Intent to Revoke, followed by issuing a Final

Order of Revocation if a hearing is not requested.

It is important to note the volume of citations needed to address non-reporters will strain OMMP’s

staff resources and also impact the Department of Justice’s resources to assist with thousands of

potential contested administrative hearings.

RECOMMENDATION 6

(OHA-OMMP) Establish inspection frequency goals and metrics and determine how

many inspectors are needed to meet those goals.

Agree or Disagree with

Recommendation

Target date to complete

implementation activities

(Generally expected within

6 months)

Name and phone number

of specific point of contact

for implementation

Agree

July 25, 2019

Carole Yann

Section Manager

971-673-2507

Narrative for Recommendation 6

The Compliance unit has four permanent and two limited duration Compliance Specialist’s to conduct

inspections, investigate complaints, and as of July 2018, complete enforcement actions resulting from

OLCC inspections of growers at locations using the CTS tracking system. An inspection includes the time

involved for preliminary processing, conducting the actual inspection, completing all post-inspection

report writing and processing of any necessary enforcement action and follow up inspections.

Based on current position authority, OMMP has set an expectation of four grow site inspections per

week per inspector, equating to 1,150 inspections with a reduction in following years due to the

limited duration positions ending July 2019. Focusing on inspections with grow sites with 2 patients

(2,610 grow sites) OMMP could conduct an annual inspection of approximately 40% of those grow

sites.

OMMP will complete a monthly report on the number of inspections, complaint investigations, and

enforcement actions the unit completes and will use that document to measure our success through

analysis of inspection outcomes ensuring that we are meeting our goals.

Without legislation to increase position authority OHA would not be able increase the number of

inspections conducted. OHA awaits direction from the Oregon legislature regarding this

recommendation and will support decision making with data and evidence-based practice.

SOS Audit Response

January 25, 2019

Page: 4

RECOMMENDATION 7

(OHA-OMMP) Under the guidance of the Governor’s office and the Legislature, review

the level of authority OMMP needs to improve its regulatory framework for security,

product tracking, and bolster resources for inspections, or consider placing the medical

marijuana compliance program within the existing OLCC authority and control

framework.

Agree or Disagree with

Recommendation

Target date to complete

implementation activities

(Generally expected within

6 months)

Name and phone number

of specific point of contact

for implementation

Agree, but not allowed

under current statute

TBD, pending provision of

statutory authority

Holly Heiberg, OHA

Government Relations

971-207-7767

Narrative for Recommendation 7

In our Operations and Compliance Assessment, submitted to the Oregon Cannabis Commission in May

2018, we acknowledge the shortcomings OHA has in regulation and that policy makers are working

towards determining which agency is and should be responsible for specific components of the law.

OHA awaits direction from the Oregon legislature regarding this recommendation and will support

decision making with data and evidence-based practice.

RECOMMENDATION 8

(OHA-OMMP) Evaluate the reasons behind high inspection staff turnover and

implement management strategies to reduce turnover.

Agree or Disagree with

Recommendation

Target date to complete

implementation activities

(Generally expected within

6 months)

Name and phone number

of specific point of contact

for implementation

Agree

July 25, 2019 or TBD,

pending position authority

Carole Yann

Section Manager

971-673-2507

Narrative for Recommendation 8

The migration of registrants from OMMP to OLCC and the decline in patients and registered medical

dispensaries and processors resulted in decreased revenue to support compliance operations and led

staff to feel insecure about the stability of the program. SB 1057, passed during the 2017 legislative

session, removed the entire compliance unit position authority effective July 1, 2018. OHA was able to

request and receive permanent position authority for four compliance specialists, and limited duration

authority for the manager, a compliance specialist 1 and an operations and policy analyst 1.

SOS Audit Response

January 25, 2019

Page: 5

The limited duration positions end July 2019. As a result, staff are concerned about their employment

status. Overall, without a stable program with permanent positions, we may continue to see staff

turnover.

Management has also acknowledged staff morale and is beginning to address staff concerns. OMMP

partnered with an Employee Assistance Program to provide employees an opportunity to bring

forward their concerns and has implemented actions to address them. Management has taken classes

and employees have received burnout prevention classes. Management is continuing to work with the

staff to address their concerns and is implementing a performance system agency wide. Staff turnover

is an important element of the performance measures.

RECOMMENDATION 9

(OHA) Perform a thorough study on the potential impacts and presence of

microbiological and heavy metal contaminants in marijuana products, to make an

informed decision on adding them to testing requirements, potentially in consultation

with a reference lab.

Agree or Disagree with

Recommendation

Target date to complete

implementation activities

(Generally expected

within 6 months)

Name and phone number

of specific point of contact

for implementation

Agree

January 25, 2020

André Ourso

Center Administrator

971-673-0403

Narrative for Recommendation 9

While OHA agrees with this recommendation, there are currently no resources to conduct such a

study. Resources would need to be allocated for this study to occur.

In the absence of dedicated resources to conduct a thorough study, OHA will reach out to other states

with legalized marijuana to request their data related to testing for specific microbiological and heavy

metal contaminants. OHA can also convene a rules advisory committee to seek guidance on testing for

microbiological and heavy metal contaminants in marijuana products.

RECOMMENDATION 10

(OHA) If microbiological and heavy metal testing are added to testing requirements,

work with testing labs and ORELAP to accredit labs for microbiological and heavy metal

testing.

Agree or Disagree with

Recommendation

Target date to complete

implementation activities

(Generally expected within

6 months)

Name and phone number

of specific point of contact

for implementation

Agree

July 25, 2019, or TBD

Carole Yann

Section Manager

971-673-2507

SOS Audit Response

January 25, 2019

Page: 6

Narrative for Recommendation 10

Depending on the study and the findings received on the potential impacts and presence of

microbiological and heavy metal contaminants in marijuana products, OHA will work with ORELAP, and

testing labs to accredit them for these additional tests in the same manner as done for pesticides,

solvents and potency.

RECOMMENDATION 11

(OHA) In consultation with the Legislature, review options for medical marijuana

testing and take action to better ensure product safety for medical marijuana

patients. Potential actions could include:

a. Implementing a public health campaign with assistance from other state agencies to

educate medical growers and patients on ways to avoid, reduce, or eliminate marijuana

product contamination;

b. Requiring testing for all medical marijuana to ensure it is free of contaminants that

may impact patient health.

Agree or Disagree with

Recommendation

Target date to complete

implementation activities

(Generally expected

within 6 months)

Name and phone number

of specific point of contact

for implementation

Agree

TBD, pending provision of

additional resources

Holly Heiberg, OHA

Government Relations

971-207-7767

Narrative for Recommendation 11

OHA acknowledges the importance of public safety and implementing a public health campaign would

be important. While OHA agrees with this recommendation, there are no resources to conduct a

campaign. Funds would need to be allocated for the campaign to occur.

OHA awaits direction from the Oregon legislature regarding this recommendation and will support

decision making with data and evidence-based practice.

RECOMMENDATION 12

(OHA) Consider developing a reference lab focused on standards and methodology

setting, additional compliance testing and random testing of marijuana products, and

assessing the overall risk of marijuana product contamination.

Agree or Disagree with

Recommendation

Target date to complete

implementation activities

(Generally expected within

6 months)

Name and phone number

of specific point of contact

for implementation

Agree

January 25, 2020

André Ourso

Center Administrator

971-673-0403

SOS Audit Response

January 25, 2019

Page: 7

Narrative for Recommendation 12

The need for a reference lab has been acknowledged in the report to the Oregon Cannabis Commission

in May 2018 as a necessary component to ensure the safety of marijuana in the market and accuracy

of cannabis testing labs. The Oregon Cannabis Commission included a recommendation to create a

reference lab in the report to the interim committees of the Legislative Assembly related to Health and

Judiciary. Funds would need to be allocated for this to be implemented.

RECOMMENDATION 13

(OHA) In consultation with OLCC, perform random compliance testing, or shelf audits, to

independently validate test results and assure product safety.

Agree or Disagree with

Recommendation

Target date to complete

implementation activities

(Generally expected within

6 months)

Name and phone number

of specific point of contact

for implementation

Agree

July 25, 2019

Carole Yann

Section Manager

971-673-2507

Narrative for Recommendation 13

OHA will work with OLCC to implement this recommendation. In the absence of a reference lab, OHA

and OLCC will partner with the Department of Agriculture to conduct the audit tests. In order to

accomplish this recommendation, additional staff resources and funding for the tests will be needed.

RECOMMENDATION 18

(OHA-ORELAP) Continue transitioning alternate matrix solvent proficiency tests in

Oregon to real matrix solvent proficiency tests.

Agree or Disagree with

Recommendation

Target date to complete

implementation activities

(Generally expected

within 6 months)

Name and phone number

of specific point of contact

for implementation

Agree June 2019

Alia D. Servin

(503) 693-4122

Narrative for Recommendation 18

As of January 1, 2019, with the new testing rule changes, ORELAP requires in-matrix proficiency testing

for pesticide and potency analyses. Currently, ORELAP is working with the proficiency test (PT) provider

Phenova to continue transitioning to a more representative in matrix proficiency test for residual

solvent samples. As a part of Phenova’s contract agreement, the contractor will continue to develop

and provide other cannabis matrix PT standards to support the OHA lab accreditation program. These

can include additional matrix standards (i.e., potency and pesticides in concentrates and edibles) as

well as additional regulated analytes as they become promulgated.

SOS Audit Response

January 25, 2019

Page: 8

RECOMMENDATION 19

(OHA-ORELAP) Complete all provisional accreditation assessments to ensure that

sampling procedures taken by labs are appropriate.

Agree or Disagree with

Recommendation

Target date to complete

implementation activities

(Generally expected

within 6 months)

Name and phone number

of specific point of contact

for implementation

Agree

June 2019

Alia D. Servin

(503) 693-4122

Narrative for Recommendation 19

Currently, ORELAP is working towards this goal in collaboration with OLCC. In November of 2018,

ORELAP requested through OLCC video footage of a selected day and time of sampling events. These

dates were selected based on the laboratory’s sampling plans and chain of custody documents to

evaluate and assess sampling protocols and practices from19 cannabis labs. As of January 23, 2019,

ORELAP received confirmation of three video recordings. Based on the cannabis laboratories’ failure to

provide the requested video recordings, ORELAP is currently scheduling on-site assessments of the

remaining ten laboratories with provisional sampling accreditation. Upon completion of the ten

laboratories’ observation assessments of sampling, there will be no provisional accreditation sampling

thereafter.

RECOMMENDATION 20

(OHA-ORELAP) Streamline the proficiency test tracking process for marijuana labs.

Agree or Disagree with

Recommendation

Target date to complete

implementation activities

(Generally expected

within 6 months)

Name and phone number

of specific point of contact

for implementation

Agree

June 2019

Alia D. Servin

(503) 693-4122

Narrative for Recommendation 20

Currently, ORELAP is working on this process in collaboration with the PT Provider and OHA IT

specialists. ORELAP has developed a summary document to keep track of laboratory’s participation in

PT studies and PT performance. It is ORELAP’s intent to transition the PT evaluation to ORELAP’s

database in order to streamline the proficiency test tracking process for cannabis labs. Additionally,

we are working closely with Phenova PT provider in order to receive PT final reports in a timely manner

to ensure appropriate corrective actions are addressed in accordance with the TNI standards.

SOS Audit Response

January 25, 2019

Page: 9

RECOMMENDATION 21

(OHA-ORELAP) Review its level of authority to address lab issues related to upholding

accreditation standards to determine what level is needed, and work with the

Legislature to make necessary adjustments.

Agree or Disagree with

Recommendation

Target date to complete

implementation activities

(Generally expected

within 6 months)

Name and phone number

of specific point of contact

for implementation

Agree, but not allowed

under current statute

TBD, pending provision of

statutory authority

Holly Heiberg, OHA

Government Relations

971-207-7767

Narrative for Recommendation 21

OHA awaits direction from the Oregon legislature regarding implementation of this recommendation.

ORELAP will support the recommendation with time capture data staff is currently compiling for

evidence-based practice.

RECOMMENDATION 22

(OHA-ORELAP) Work with OLCC and the Legislature to ensure appropriate and

sufficient staff coverage to better monitor lab practices and review test result data.

Agree or Disagree with

Recommendation

Target date to complete

implementation activities

(Generally expected

within 6 months)

Name and phone number

of specific point of contact

for implementation

Agree, but not allowed

under current statute

TBD, pending provision of

statutory authority

Holly Heiberg, OHA

Government Relations

971-207-7767

Narrative for Recommendation 22

OHA awaits direction from the Oregon legislature regarding implementation of this recommendation.

ORELAP will support the recommendation with time capture data staff is currently compiling for

evidence-based practice.

RECOMMENDATION 23

(OHA-ORELAP) Develop a strategy to meet established response timelines for

addressing proficiency test failures and other lab accreditation deficiencies.

Agree or Disagree with

Recommendation

Target date to complete

implementation activities

(Generally expected

within 6 months)

Name and phone number

of specific point of contact

for implementation

Agree

June 2019 Alia D. Servin

(503) 693-4122

SOS Audit Response

January 25, 2019

Page: 10

Narrative for Recommendation 23

ORELAP is working on this strategy in collaboration with the PT provider to receive the final reports in a

timely manner and to ensure the appropriate corrective actions are addressed in accordance to the TNI

standards and ORELAP Program policies. Once the PT results are received from the PT provider, PT

results will be evaluated for conformance to the TNI standard to determine the accreditation status of

a laboratory within 60 days of the receipt of the final report from the PT provider.

ORELAP is currently developing a summary document that contains historical information about the

cannabis labs PT results to meet the established timeline for the evaluation of proficiency test failures

and to address cannabis labs PT failures in a timely manner and according to ORELAP Program policies.

The accreditation status is based on a laboratory maintaining a history of at least two successful

performances out of the most recent three PT samples analyzed for the same accreditation FoPT. Upon

any desk review, ORELAP sends a letter requesting information regarding the unacceptable

performances. The ORELAP manager will notify the laboratory’s director by registered mail, return

receipt, of suspension of accreditation. The notification shall include the beginning date of the

suspension, which elements are suspended and the reasons for the suspension. If the cause of

suspension has not been corrected within six months or the period of accreditation, whichever is

shorter, the status of the affected fields of testing will change to revoked.

Please contact Carole Yann, Oregon Medical Marijuana Section Manager at 971-673-2507 with any

questions.

Sincerely,

Patrick M. Allen

Director

EC: Steve Winn

Andrew Love

Ariana Denney

William Garber

Kris Kautz

Andre Ourso

Carole Yann

Alia Servin

Jonathan Modie

Karen Slothower

Sarah Landis

Stephanie Ringsage

About the Secretary of State Audits Division

The Oregon Constitution provides that the Secretary of State shall be, by virtue of his office, Auditor of Public

Accounts. The Audits Division performs this duty. The division reports to the elected Secretary of State and is

independent of other agencies within the Executive, Legislative, and Judicial branches of Oregon government.

The division has constitutional authority to audit all state officers, agencies, boards and commissions as well as

administer municipal audit law.

This report is intended to promote the best possible management of public resources.

Copies may be obtained from:

Audit Team

William Garber, CGFM, MPA, Deputy Director

Andrew Love, CFE, Audit Manager

Stephen Winn, MPP, Principal Auditor

Bonnie Crawford, MPA, Senior Auditor

Ariana Denney, MPA, Staff Auditor

Oregon Audits Division

255 Capitol St NE, Suite 500 | Salem | OR | 97310

(503) 986-2255

sos.oregon.gov/audits