Are you testing into compliance?

The Barr Decision of 1993 introduced the phrase “Testing into Compliance”.  The court case between Barr Laboratories and the Food and Drug Administration (FDA) led to new interpretations of FDA rules and the release of the 1998 version of FDA Guidance for Industry, Investigating Out of Specification (OOS) Test Results for Pharmaceutical Production. The final version was approved in 2006 and has since been revised in 2022.  

“Testing into Compliance” is defined as analyzing a sample until a desired result is obtained, then reporting that value while ignoring all previous values. These Out of Specification (OOS) test results may occur in approximately 5% of product lots even if the product meets defined specifications. 

Most states with medical cannabis programs require testing laboratories to be accredited to ISO 17025, General requirements for the competence of testing and calibration laboratories.

One of the most significant compliance gaps Triskele has identified when assessing cannabis laboratories seeking ISO 17025 accreditation is the lack of a Standard Operating Procedure (SOP) to address and investigate OOS test results and to define a retesting plan, which should include an approved justification for retesting.

The most common action noted when a sample failed was simply to retest until the result passed specification. Unlike the FDA, the ISO standard does not specifically require laboratories to have an SOP to address OOS results. The standard does require a procedure for Nonconforming work, but in all of the assesments conducted by Triskele, OOS results are out of scope for that procedure. 

Ultimately, how would cannabis laboratories know how to adequately and effectively conduct OOS investigations when a procedure to address OOS test results is not a requirement of the accreditation process, and ISO accreditation is a requirement for cannabis laboratories to operate?

As an example, Scale Laboratories in Oklahoma City learned the hard way how testing into compliance can jeopardize their business. Not only did the laboratory retest until it got a desired result, but the laboratory also falsified data by reporting passing results when in fact the samples failed specifications. As a result, 99 products were recalled, and the laboratory’s license was suspended.

What is the risk of not having an OOS and retest procedure? The risk of highest concern is the distribution of adulterated products to consumers. The next, as Scale Laboratories found out, is the risk to an organization’s bottom line and brand recognition.