ISO 17025 Cannabis Lab Accreditation: Complete QAP Verification Guide

If your lab lost accreditation tomorrow, would every lot you released in the last 90 days still be compliant?

Before accepting a cannabis COA as compliance-valid, a Canadian QAP confirms four things about the issuing lab: ISO 17025 cannabis lab accreditation, the accreditation scope actually covers the tested analytes, the lab appears on the Health Canada approved list, and the certificate has not expired. ISO 17025 accreditation is the foundation, but on its own it is not enough. This article walks through what the standard actually requires, how to verify scope against your analyte list, how to cross-check against Health Canada, and how to build quarterly supplier re-verification into your quality management system.

If you want the broader context, our complete cannabis COA guide covers cannabinoids, heavy metals, pesticides, residual solvents, and the microbial section in one reference, alongside the lab accreditation workflow.

What ISO/IEC 17025 Actually Means for Cannabis Testing

ISO/IEC 17025:2017 is the international benchmark for the competence of testing and calibration laboratories. It is published jointly by the International Organization for Standardization and the International Electrotechnical Commission, and recognised by accreditation bodies in more than 100 countries. The current edition, ISO/IEC 17025:2017, replaced the 2005 edition on 29 November 2017.

Two things make 17025 different from ISO 9001. First, it covers technical competence, not just management system maturity: the lab must demonstrate it gets the right answer, not just that it follows documented procedures. Second, the accreditation body audits the specific test methods in the scope. A lab that has scope for cannabinoid potency by HPLC has been observed running that method, on that instrument, by that analyst, and has passed proficiency testing for it.

For Canadian cannabis QAPs, three 17025 elements matter more than the rest:

• Method validation. Every method in the scope has a validation package: specificity, linearity, accuracy, precision, limit of detection, limit of quantitation, range, robustness. A lab that cannot produce the validation package on request is not running that method under 17025.
• Measurement uncertainty. The lab must calculate and report uncertainty for quantitative results. A COA reporting THC at 18.2% without an uncertainty budget behind it is incomplete under 17025. Most labs do not print uncertainty on the public COA, but they must provide it on request.
• Proficiency testing. The lab participates in external PT schemes for every analyte group in the scope. Unsatisfactory PT performance triggers corrective action and can result in scope reduction.

A QAP who cannot articulate these three elements to an inspector will struggle to defend the supplier qualification file. The standard is the audit trail that lets your release decision stand up to regulatory scrutiny.

The Scope of Accreditation, Where Most QAPs Miss the Mark

A lab can be ISO 17025 accredited for environmental water testing and have zero scope for cannabinoid quantitation. The certificate is only meaningful when paired with the scope annex, which lists each method, matrix, and analyte covered. The common failure pattern: a QAP sees the 17025 logo, skips the scope, and accepts the COA. Twelve months later, a Health Canada inspector asks to see the scope annex, discovers the lab never had scope for pesticides by GC-MS, and the pesticide history of every lot tested becomes a compliance problem.

A proper accreditation package contains two documents: the certificate (one page, confirms active status and expiry), and the scope annex (multiple pages, lists every method). The scope annex is where the real work sits. For a Canadian cannabis lab, the scope should explicitly cover each analyte family below against the cannabis matrices you actually ship.

Matrices are not interchangeable. A lab with HPLC cannabinoid scope on dried flower does not automatically have scope on chocolate edibles: matrix effect, extraction recovery, and method validation differ. Match your actual product formats against the matrix column in the scope. If you ship infused beverages, the scope must cover aqueous matrices, not just flower.

How Do I Verify a Cannabis Lab’s ISO 17025 Certificate?

Verification is a five step routine that belongs in your supplier qualification SOP. Done well, it takes under 30 minutes per lab per quarter. Done badly (or not at all) it becomes a written observation on your next Health Canada inspection.

1. Request the certificate and the scope annex in writing. Email the lab’s quality manager, not the sales contact. Ask for the current certificate PDF, the full scope annex, and the most recent proficiency testing summary for your analyte groups. A lab that cannot produce these within five business days is either understaffed or hiding something.
2. Verify against the accreditation body’s public register. In Canada, that is the Standards Council of Canada (SCC) Directory of Accredited Organizations. In the US, check A2LA, IAS, or ANAB. The public register is the single source of truth: a PDF certificate can be altered, the register cannot. Screenshot the register entry.
3. Check the expiry date. 17025 accreditation runs in four year cycles with annual surveillance audits. A certificate within 90 days of expiry is a watch flag. A certificate past expiry is a disqualifier until renewal evidence is produced.
4. Cross-reference the scope annex against your analyte list. Print both documents. Tick every match, flag every gap. Gaps are the conversation to have with the lab before the next lot ships.
5. Document the verification in your supplier management SOP. File the certificate, scope, register screenshot, and gap analysis. Sign and date. Next quarter, the refresh takes 10 minutes because the baseline is already there.

A QAP who runs this routine once per quarter catches scope reductions, expiry lapses, and accreditation body sanctions before they land on an inspection finding.

Health Canada’s Approved List, The Second Gate

ISO 17025 accreditation is necessary but not sufficient. Under the Cannabis Regulations (SOR/2018-144), analytical testing to support lot release must be performed by a lab that holds a current Dealer’s Licence or is otherwise authorised by Health Canada. Health Canada publishes the list of authorised analytical testing labs on its website, and a lab must appear on both the 17025 public register AND the Health Canada list for its COA to be compliance-valid in Canada.

Labs occasionally come off the Health Canada list. Reasons range from voluntary licence surrender, to scope restrictions after inspection, to enforcement action. When a lab is removed, active testing must be redirected to an approved alternative, and the QAP has to decide whether historical lots need retesting. The Cannabis Regulations do not automatically invalidate historical COAs from a lab that later loses its status, but the QAP must document the assessment.

Quarterly re-verification must therefore check both the Health Canada list and the SCC register. The two agencies do not synchronise in real time: a lab can be SCC-accredited and Health Canada-suspended simultaneously, and the only way to catch that combination is to check both sources.

Building Quarterly Re-verification Into Your QA SOP

Accreditation is not set-and-forget. Certificates expire. Scopes can be reduced after audit findings. Compliance actions can be open for months without the lab proactively disclosing them. Treat lab re-verification the way the facility treats packaging supplier re-verification or calibration records: scheduled, documented, signed.

A workable quarterly routine for a multi-lab panel looks like this:

Triggers for an out-of-cycle audit: an unexpected COA result (unusually favourable or unexpectedly clean), a missed turnaround, a scope reduction, a change in the lab’s quality manager or technical director, or a Health Canada inspection observation that references the lab. Treat these as high-priority supplier events. For the analyte-specific context that drives these audits, see our pages on cannabis microbial testing limits and cannabis heavy metals testing limits.

What Happens if My Lab Loses ISO 17025 Accreditation Mid-Lot?

Any lot tested under the lapsed scope is non-compliant by default until the situation is clarified. The QAP response has four moves: quarantine, investigation, decision, documentation.

1. Quarantine. Every lot in inventory released on a COA from the now-lapsed lab goes into system and physical quarantine within 24 hours.
2. Investigation. Determine the root cause of the lapse: voluntary withdrawal of a method, surveillance audit non-conformance, Health Canada suspension for cause. A scope reduction in a method you did not use is harmless. A systematic analytical deficiency affecting your panel means retest.
3. Decision. Common paths: retest at a different accredited lab, accept the original COA if the lapse is unrelated to your methods (requires documented rationale signed by the QAP), or destroy. If any unit has already shipped, recall obligations under Part 6 of the Cannabis Regulations may apply.
4. Documentation. File the deviation report, investigation record, decision rationale, retest COAs, and a CAPA for the supplier qualification programme.

Qualify at least two labs for every analyte group you rely on. A single-lab programme is a compliance risk the day that single lab has a bad audit.

Frequently Asked Questions

What is the difference between ISO 17025 and ISO 9001 for cannabis labs?

ISO 9001 certifies the lab’s management system: documented procedures, customer focus, continual improvement. ISO 17025 certifies technical competence: validated methods, calculated measurement uncertainty, and documented proficiency testing. A cannabis lab can hold ISO 9001 and still produce analytically meaningless data. ISO 17025 is the standard that lets the COA stand up in a Health Canada inspection. For analytical testing under the Cannabis Regulations, 17025 is the relevant benchmark, not 9001.

Does a lab need separate accreditation for each cannabis test method?

Yes. ISO 17025 accreditation is method-specific, not lab-wide. The accreditation body audits each test method on the scope individually: cannabinoid potency by HPLC, pesticides by LC-MS/MS, heavy metals by ICP-MS, microbial by European Pharmacopoeia plate count, and so on. A lab that adds a new method (for example, mycotoxins by LC-MS/MS) must extend its scope and pass an audit for that method before the results carry accreditation weight. When qualifying a lab, verify the scope annex lists every method you rely on, with every matrix you produce.

How often are ISO 17025 certificates audited for cannabis labs?

The standard accreditation cycle is four years with annual surveillance audits. The initial assessment is comprehensive and includes on-site observation of method execution. Surveillance audits in years two, three, and four focus on management system maintenance, proficiency testing performance, and a rotating sample of methods on the scope. A full reassessment happens at year four. If a surveillance audit finds non-conformance, the accreditation body can restrict the scope, suspend it, or withdraw it depending on severity. QAPs should request the date of the most recent audit as part of quarterly re-verification.

Can I use a US-accredited lab for Canadian cannabis testing?

Only if the lab also appears on Health Canada’s list of authorised analytical testing labs. ISO 17025 accreditation is internationally recognised, so an A2LA or ANAB accreditation is technically equivalent to an SCC accreditation for the 17025 framework. But analytical testing to support lot release under the Cannabis Regulations requires separate Health Canada authorisation, tied to a Canadian legal entity. Almost all Canadian cannabis release testing is therefore performed by Canadian labs. A US lab can perform supplementary testing (for example, export-market verification) but should not be the primary release lab unless it holds Canadian authorisation.